向左移动
If a developer writes a cross-site scripting error as they're coding in JavaScript, and they're able to detect that within minutes of creating that flaw, it will likely only require minutes or seconds to fix.
Whereas if that flaw is discovered two weeks later by a manual tester, that's going to be then entered into a defect tracking system. It's going to be triaged. It's going to be put into someone's bug queue.
With the delay in identification, it will have to be researched in its original context and will slow down development. Now, you're potentially talking hours of time to fix the same flaw. Maybe a scale of 10 or 100 times more time is taken
I couldn't agree with Chris Wysopal (CTO, Veracode) more in his recent podcast with O'Reilly Security Podcast where he explains why shifting security to the left (to developers at the start of the development life cycle) is key in an agile environment to keep up the pace and speed.
Security should be made easy for developers by using IDE plug-ins, scanners and educating them to have the basic security skills (hygiene). Organisations should not be solely relying on security experts or a centralised security team who validates all changes.
Our typical security modus operandi is broken (call in the expert!) and we need to integrate security into development teams to ensure quality is maintained whilst staying agile.
Chief Executive Officer, Chairman, and Co-Founder
Secure Code Warrior可以帮助您的组织在整个软件开发生命周期中保护代码，并营造一种将网络安全放在首位的文化。无论您是 AppSec 经理、开发人员、首席信息安全官还是任何与安全相关的人，我们都可以帮助您的组织降低与不安全代码相关的风险。
预订演示
Chief Executive Officer, Chairman, and Co-Founder
Pieter Danhieux is a globally recognized security expert, with over 12 years experience as a security consultant and 8 years as a Principal Instructor for SANS teaching offensive techniques on how to target and assess organizations, systems and individuals for security weaknesses. In 2016, he was recognized as one of the Coolest Tech people in Australia (Business Insider), awarded Cyber Security Professional of the Year (AISA - Australian Information Security Association) and holds GSE, CISSP, GCIH, GCFA, GSEC, GPEN, GWAPT, GCIA certifications.
If a developer writes a cross-site scripting error as they're coding in JavaScript, and they're able to detect that within minutes of creating that flaw, it will likely only require minutes or seconds to fix.
Whereas if that flaw is discovered two weeks later by a manual tester, that's going to be then entered into a defect tracking system. It's going to be triaged. It's going to be put into someone's bug queue.
With the delay in identification, it will have to be researched in its original context and will slow down development. Now, you're potentially talking hours of time to fix the same flaw. Maybe a scale of 10 or 100 times more time is taken
I couldn't agree with Chris Wysopal (CTO, Veracode) more in his recent podcast with O'Reilly Security Podcast where he explains why shifting security to the left (to developers at the start of the development life cycle) is key in an agile environment to keep up the pace and speed.
Security should be made easy for developers by using IDE plug-ins, scanners and educating them to have the basic security skills (hygiene). Organisations should not be solely relying on security experts or a centralised security team who validates all changes.
Our typical security modus operandi is broken (call in the expert!) and we need to integrate security into development teams to ensure quality is maintained whilst staying agile.
If a developer writes a cross-site scripting error as they're coding in JavaScript, and they're able to detect that within minutes of creating that flaw, it will likely only require minutes or seconds to fix.
Whereas if that flaw is discovered two weeks later by a manual tester, that's going to be then entered into a defect tracking system. It's going to be triaged. It's going to be put into someone's bug queue.
With the delay in identification, it will have to be researched in its original context and will slow down development. Now, you're potentially talking hours of time to fix the same flaw. Maybe a scale of 10 or 100 times more time is taken
I couldn't agree with Chris Wysopal (CTO, Veracode) more in his recent podcast with O'Reilly Security Podcast where he explains why shifting security to the left (to developers at the start of the development life cycle) is key in an agile environment to keep up the pace and speed.
Security should be made easy for developers by using IDE plug-ins, scanners and educating them to have the basic security skills (hygiene). Organisations should not be solely relying on security experts or a centralised security team who validates all changes.
Our typical security modus operandi is broken (call in the expert!) and we need to integrate security into development teams to ensure quality is maintained whilst staying agile.
点击下面的链接并下载此资源的PDF。
Secure Code Warrior可以帮助您的组织在整个软件开发生命周期中保护代码，并营造一种将网络安全放在首位的文化。无论您是 AppSec 经理、开发人员、首席信息安全官还是任何与安全相关的人，我们都可以帮助您的组织降低与不安全代码相关的风险。
查看报告预订演示
Chief Executive Officer, Chairman, and Co-Founder
Pieter Danhieux is a globally recognized security expert, with over 12 years experience as a security consultant and 8 years as a Principal Instructor for SANS teaching offensive techniques on how to target and assess organizations, systems and individuals for security weaknesses. In 2016, he was recognized as one of the Coolest Tech people in Australia (Business Insider), awarded Cyber Security Professional of the Year (AISA - Australian Information Security Association) and holds GSE, CISSP, GCIH, GCFA, GSEC, GPEN, GWAPT, GCIA certifications.
If a developer writes a cross-site scripting error as they're coding in JavaScript, and they're able to detect that within minutes of creating that flaw, it will likely only require minutes or seconds to fix.
Whereas if that flaw is discovered two weeks later by a manual tester, that's going to be then entered into a defect tracking system. It's going to be triaged. It's going to be put into someone's bug queue.
With the delay in identification, it will have to be researched in its original context and will slow down development. Now, you're potentially talking hours of time to fix the same flaw. Maybe a scale of 10 or 100 times more time is taken
I couldn't agree with Chris Wysopal (CTO, Veracode) more in his recent podcast with O'Reilly Security Podcast where he explains why shifting security to the left (to developers at the start of the development life cycle) is key in an agile environment to keep up the pace and speed.
Security should be made easy for developers by using IDE plug-ins, scanners and educating them to have the basic security skills (hygiene). Organisations should not be solely relying on security experts or a centralised security team who validates all changes.
Our typical security modus operandi is broken (call in the expert!) and we need to integrate security into development teams to ensure quality is maintained whilst staying agile.
帮助您入门的资源
Trust Agent:AI - Secure and scale AI-Drive development
AI is writing code. Who’s governing it? With up to 50% of AI-generated code containing security weaknesses, managing AI risk is critical. Discover how SCW's Trust Agent: AI provides the real-time visibility, proactive governance, and targeted upskilling needed to scale AI-driven development securely.
The Power of OpenText Application Security + Secure Code Warrior
OpenText Application Security and Secure Code Warrior combine vulnerability detection with AI Software Governance and developer capability. Together, they help organizations reduce risk, strengthen secure coding practices, and confidently adopt AI-driven development.
Secure Code Warrior corporate overview
Secure Code Warrior is an AI Software Governance platform designed to enable organizations to safely adopt AI-driven development by bridging the gap between development velocity and enterprise security. The platform addresses the "Visibility Gap," where security teams often lack insights into shadow AI coding tools and the origins of production code.
.png)
