In this most festive of annual occasions for cybersecurity professionals, National Cybersecurity Awareness Month is a time many companies utilize to reflect on, and appraise, the general security awareness heartbeat across the organization. And with 62% of business experiencing a phishing or social engineering attack in 2018 alone, the importance of ensuring every individual in the business -- whether in a security role or not -- has adequate cybersecurity awareness training cannot be overstated.
As an increasingly global event, the month represents a catch-all for discussing best practices, and the initiatives are deliberately surface-level. However, even organizations with robust security programs and in-house specialists can use this time to assess the more technical teams for what they need to become more security-aware in the context of their role.
For AppSec specialists, development team leads, and the more security-savvy members of the engineering cohort, it might feel a bit like being taught how to suck eggs, but it is these champions within the business that can push security and safety to new heights, company-wide.
How to elevate your Cybersecurity Awareness Month
This is a golden opportunity for the security team to extend something of an olive branch to the development team, perhaps in the form of inter-team activities and programs that can help developers feel more positive about security in the context of their work.
Some kick-off ideas include:
- Help developers get the support they need to learn about secure coding. Not having the right tools for the job is a great way to feel justified in slam-dunking a task into the Too Hard Basket. If developers don't have the right training and tools to see security as a priority in the coding process, then it's no wonder so many teams are ill-equipped to keep common vulnerabilities out of their code.
Use this month to understand what is missing in the development tech stack, which managers can work together to improve communication and increase security visibility, and who can continue advocating for and championing security going forward.
- Host a "Lunch and Learn'event. The cybersecurity and development communities are, in general, brimming with incredibly generous people who are only too happy to share their expertise. Reach out to conference speakers, tech peers in other companies, or even local OWASP chapters, and see who might be able to come in and chat with the team, or record a webinar with someone in the organization. It's a relatively quick win, and it can be a huge benefit for up-and-coming developers to see different security career pathways in front of them.
- Gather for some friendly competition. Learning about security is a lot more fun when you do something a little different and special. Secure coding tournaments are a great way to get developers testing their secure coding skills, and competing with their peers in a gamified environment. Get a fancy dress theme happening, and be creative with the teams (how about developers vs. their managers?). Order some pizza, drinks, get some energetic music pumping, and it can be an event to remember for the whole organization.
Giving back to the community: Download your free Secure Code Bootcamp app
I'm a developer myself, and it has always been the case that we search for what we can share and use for free. It's a point of pride to make some freeware that might help others, and this month is a good time to reflect on our roots and look at what we can provide to the community.
To that end, we're pleased to announce our new, free app, Secure Code Bootcamp. This is a pocket secure coding companion for coders who want to challenge themselves, progressively boosting their security awareness anywhere, anytime.
Download the app for iOS and Android now, and learn how to locate and identify OWASP vulnerabilities in Node.JS, Python:Django, Java:Spring, C# .NET: MVC:
