Helping developers rally for secure code year-round – SecAdvent Day 11

Another national cybersecurity awareness month has come and gone, serving as a month-long reminder that there are other scary threats out there, existing outside of the spooky stuff often seen around Halloween in October.

It’s a time of reflection for many companies, some of which use it to assess current levels of security awareness across the organization. Training on social engineering-based vulnerabilities like phishing emails isn’t uncommon, but the best companies dedicate significant time to the technical side of security within the business, and they bring developers on that journey so they can keep cybersecurity front-of-mind as they build software.  Typically, this takes the form of some education around coding securely, and perhaps a “capture the flag” style activity or two.

There’s just one problem, however: at the conclusion of these security-focused events, it can be the case that these activities are packed up and put away until the next one. In a climate where cybercrime is tipped to cost the world $6 trillion by 2021, we simply can’t afford to put security on the backburner for eleven months of the year. And the development teams sitting within most organizations are key to stemming the flow of software vulnerabilities and subsequent data breaches, if only they had the knowledge and skills to eradicate common security bugs from the beginning of the software development process.

There are no easy answers when it comes to fighting cyber threats, but if security was intrinsic to the developer workflow, and they were supported to take their rightful place in a seamless DevSecOps environment, we’d be much better off.

To that end, here are some ideas for making security — and secure coding — a theme for developers year-round.

Champion a more secure development process

Helping consumers stay safe online is a noble goal. But companies, especially those that create and deploy software, need to go beyond that. The very best companies will prioritize a full-scale security program that ensures that all employees can play a part in defending private data. And it’s the development team that stands to benefit the most from the right approach.

One of the best ways to support this effort is by establishing security champions within your developer community. Champions are essentially volunteers who help spread the word about an organization’s security message, while staying alert to potential issues as they crop up. They don’t have to be security pros. In fact, the nature of their mission requires that they have other areas of expertise, like high EQ and communication skills. But each champion should have a great interest in security and in ensuring that the organization’s software and applications provide necessary controls and protections.

The most successful organizations place champions in the developer cohort. It’s well known that AppSec teams and developers often clash, because their objectives don’t always seem to be in alignment. But ultimately, they have the same goal of deploying working software in a safe way that both protects and serves their users. Having security champions working together on both sides of that fence can go a long way to uniting the two groups in their common goal. Particularly  for developers, becoming security-aware can provide extremely marketable skills that allow them to shine above their less security-minded colleagues.