For developers to help slay the cybercrime beast, training is a quest in two parts
A version of this article appeared in DevOps.com. It has been updated and syndicated here.
The playing field between the heroes and villains in cybersecurity is notoriously unfair. Sensitive data is the new gold, and attackers adapt quickly to circumvent defenses, exploiting security bugs large and small for potential paydirt.
The volume of code being produced is too great for security experts -- of increasing scarcity -- to contend with, and the rising cost of data breaches is proof that something has got to give. Fortunately, for the sake of our digital safety and the sanity of CISOs everywhere, the DevSecOps movement is helping to bring developers on the security journey from the beginning of the software development process. They are being recognized as the first line of defense against cyberattackers, with the power to eliminate common vulnerabilities at their fingertips.
However, their defensive capabilities are only as good as the training they receive, and that is yet another gauntlet for security teams to run. For many developers receiving training in secure coding on the job, their key challenge is staying awake during mind-numbing, hands-off activities that are neither effective, nor inspiring them to keep security front-of-mind. Soulless video courses aren’t getting us there, token annual ‘tick-the-box’ events are a waste of time, and nobody is winning against the potential malicious threat actor waiting to jump on a small window of opportunity.
At this stage in our industry, we have worked out that contextual, hands-on education that is delivered in relevant programming languages and frameworks, with challenges that mimic those a developer might come across in the real world, is a far more engaging approach.
This is phase one of a developer’s quest to help AppSec gurus slay common vulnerabilities, but phase two is where scenarios must get real for a supercharged, security-aware defensive force.
Scaffolded learning is critical in adult education
When it comes to extracurricular courses or on-the-job training, it is often overlooked that adults bring with them a certain level of experience and existing knowledge. Good training adds to this foundation, and is structured in a way that allows for deeper understanding and faster autonomy in the learning process.
Scaffolded education is a potent, positive method of learning that seeks to activate and enhance prior experience, while continuing to build new skills - in manageable chunks - that allow the tutee to tackle increasingly difficult tasks with more confidence. Typically, it is a methodology best served with healthy portions of demonstration, visual aids, and student-led exploration.
If we tie this approach back to developer security training, it comes as no surprise that the dynamic, learn-by-doing method has long been preferred over the drudgery that is theory-based static learning. They are free to be the masters of their domain, and should see that their time is well spent.
In that sense, learning to code securely in a hyper-relevant, contextual environment is key, but the ‘level up’ from this step is to see an exploit of vulnerable code in action. With the context of frontend and backend views side-by-side, there is a tangible link between actions taken during the coding process, and what an attacker can potentially do with cut corners, misconfigurations, or accidents that are not caught and remedied.
Move from recall to application for a truly preventative security approach
Experiencing the impact of security vulnerabilities first-hand is a vital piece of the education puzzle, and it’s a fairly rare beast, even with the most modern security training options for developers. The foundational work spent on honing skills in spotting and remediating vulnerabilities, and recalling that experience to eliminate the same bugs in code as it is being written is extremely important, but it’s not the whole picture. To see how vulnerable code is exploited by a malicious actor adds a powerful layer of context, one that really drives home the importance of securing code, and applying hard-earned security knowledge to close every window of opportunity.
It is generally accepted that developers don’t love security, and they have even less affection for security training. Their experiences with AppSec specialists can be very frosty, and the rework caused by the security team bouncing vulnerable code back to developers for remediation is the bane of their existence. To an engineering team that is already spread thin, security is someone else’s problem, not their priority, and a hindrance to their natural creativity and primary objective of building features. However, there is simply too much code, too many breaches, and too much risk to the world’s data for this mindset to continue.
A functional DevSecOps process has developers working in harmony with security teams right at the beginning of the SDLC, and the opportunity for applied learning where they can interact with a simulated exploit, and see the impact of poorly secured code goes a long way in getting developers on the same page as those pesky AppSec people (who aren’t so bad after all).
Interactive learning prepares developers for the boss fight
At the time of writing, there were two major breaches reported in a 7-day period: Razer announced that over 100,000 sensitive data records had been exposed, while office supplies chain Staples also reported a similar data leak. Over a billion sensitive records have been exposed so far in 2020, and this worrying trend shows no signs of slowing down. Simply put, malicious actors have the upper hand, and security-aware developers are sorely needed to serve as the front line of defense.
Interactive challenges that focus on simulating such breaches move developers from passive recall, to applying skills that have an impact on the real boss fight: stopping attackers in their tracks.
The playing field between the heroes and villains in cybersecurity is notoriously unfair. Sensitive data is the new gold, and attackers adapt quickly to circumvent defenses, exploiting security bugs large and small for potential paydirt.
Matias Madou, Ph.D. is a security expert, researcher, and CTO and co-founder of Secure Code Warrior. Matias obtained his Ph.D. in Application Security from Ghent University, focusing on static analysis solutions. He later joined Fortify in the US, where he realized that it was insufficient to solely detect code problems without aiding developers in writing secure code. This inspired him to develop products that assist developers, alleviate the burden of security, and exceed customers' expectations. When he is not at his desk as part of Team Awesome, he enjoys being on stage presenting at conferences including RSA Conference, BlackHat and DefCon.
Secure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.
Book a demo
Matias Madou, Ph.D. is a security expert, researcher, and CTO and co-founder of Secure Code Warrior. Matias obtained his Ph.D. in Application Security from Ghent University, focusing on static analysis solutions. He later joined Fortify in the US, where he realized that it was insufficient to solely detect code problems without aiding developers in writing secure code. This inspired him to develop products that assist developers, alleviate the burden of security, and exceed customers' expectations. When he is not at his desk as part of Team Awesome, he enjoys being on stage presenting at conferences including RSA Conference, BlackHat and DefCon.
Matias is a researcher and developer with more than 15 years of hands-on software security experience. He has developed solutions for companies such as Fortify Software and his own company Sensei Security. Over his career, Matias has led multiple application security research projects which have led to commercial products and boasts over 10 patents under his belt. When he is away from his desk, Matias has served as an instructor for advanced application security training courses and regularly speaks at global conferences including RSA Conference, Black Hat, DefCon, BSIMM, OWASP AppSec and BruCon.
Matias holds a Ph.D. in Computer Engineering from Ghent University, where he studied application security through program obfuscation to hide the inner workings of an application.
A version of this article appeared in DevOps.com. It has been updated and syndicated here.
The playing field between the heroes and villains in cybersecurity is notoriously unfair. Sensitive data is the new gold, and attackers adapt quickly to circumvent defenses, exploiting security bugs large and small for potential paydirt.
The volume of code being produced is too great for security experts -- of increasing scarcity -- to contend with, and the rising cost of data breaches is proof that something has got to give. Fortunately, for the sake of our digital safety and the sanity of CISOs everywhere, the DevSecOps movement is helping to bring developers on the security journey from the beginning of the software development process. They are being recognized as the first line of defense against cyberattackers, with the power to eliminate common vulnerabilities at their fingertips.
However, their defensive capabilities are only as good as the training they receive, and that is yet another gauntlet for security teams to run. For many developers receiving training in secure coding on the job, their key challenge is staying awake during mind-numbing, hands-off activities that are neither effective, nor inspiring them to keep security front-of-mind. Soulless video courses aren’t getting us there, token annual ‘tick-the-box’ events are a waste of time, and nobody is winning against the potential malicious threat actor waiting to jump on a small window of opportunity.
At this stage in our industry, we have worked out that contextual, hands-on education that is delivered in relevant programming languages and frameworks, with challenges that mimic those a developer might come across in the real world, is a far more engaging approach.
This is phase one of a developer’s quest to help AppSec gurus slay common vulnerabilities, but phase two is where scenarios must get real for a supercharged, security-aware defensive force.
Scaffolded learning is critical in adult education
When it comes to extracurricular courses or on-the-job training, it is often overlooked that adults bring with them a certain level of experience and existing knowledge. Good training adds to this foundation, and is structured in a way that allows for deeper understanding and faster autonomy in the learning process.
Scaffolded education is a potent, positive method of learning that seeks to activate and enhance prior experience, while continuing to build new skills - in manageable chunks - that allow the tutee to tackle increasingly difficult tasks with more confidence. Typically, it is a methodology best served with healthy portions of demonstration, visual aids, and student-led exploration.
If we tie this approach back to developer security training, it comes as no surprise that the dynamic, learn-by-doing method has long been preferred over the drudgery that is theory-based static learning. They are free to be the masters of their domain, and should see that their time is well spent.
In that sense, learning to code securely in a hyper-relevant, contextual environment is key, but the ‘level up’ from this step is to see an exploit of vulnerable code in action. With the context of frontend and backend views side-by-side, there is a tangible link between actions taken during the coding process, and what an attacker can potentially do with cut corners, misconfigurations, or accidents that are not caught and remedied.
Move from recall to application for a truly preventative security approach
Experiencing the impact of security vulnerabilities first-hand is a vital piece of the education puzzle, and it’s a fairly rare beast, even with the most modern security training options for developers. The foundational work spent on honing skills in spotting and remediating vulnerabilities, and recalling that experience to eliminate the same bugs in code as it is being written is extremely important, but it’s not the whole picture. To see how vulnerable code is exploited by a malicious actor adds a powerful layer of context, one that really drives home the importance of securing code, and applying hard-earned security knowledge to close every window of opportunity.
It is generally accepted that developers don’t love security, and they have even less affection for security training. Their experiences with AppSec specialists can be very frosty, and the rework caused by the security team bouncing vulnerable code back to developers for remediation is the bane of their existence. To an engineering team that is already spread thin, security is someone else’s problem, not their priority, and a hindrance to their natural creativity and primary objective of building features. However, there is simply too much code, too many breaches, and too much risk to the world’s data for this mindset to continue.
A functional DevSecOps process has developers working in harmony with security teams right at the beginning of the SDLC, and the opportunity for applied learning where they can interact with a simulated exploit, and see the impact of poorly secured code goes a long way in getting developers on the same page as those pesky AppSec people (who aren’t so bad after all).
Interactive learning prepares developers for the boss fight
At the time of writing, there were two major breaches reported in a 7-day period: Razer announced that over 100,000 sensitive data records had been exposed, while office supplies chain Staples also reported a similar data leak. Over a billion sensitive records have been exposed so far in 2020, and this worrying trend shows no signs of slowing down. Simply put, malicious actors have the upper hand, and security-aware developers are sorely needed to serve as the front line of defense.
Interactive challenges that focus on simulating such breaches move developers from passive recall, to applying skills that have an impact on the real boss fight: stopping attackers in their tracks.
A version of this article appeared in DevOps.com. It has been updated and syndicated here.
The playing field between the heroes and villains in cybersecurity is notoriously unfair. Sensitive data is the new gold, and attackers adapt quickly to circumvent defenses, exploiting security bugs large and small for potential paydirt.
The volume of code being produced is too great for security experts -- of increasing scarcity -- to contend with, and the rising cost of data breaches is proof that something has got to give. Fortunately, for the sake of our digital safety and the sanity of CISOs everywhere, the DevSecOps movement is helping to bring developers on the security journey from the beginning of the software development process. They are being recognized as the first line of defense against cyberattackers, with the power to eliminate common vulnerabilities at their fingertips.
However, their defensive capabilities are only as good as the training they receive, and that is yet another gauntlet for security teams to run. For many developers receiving training in secure coding on the job, their key challenge is staying awake during mind-numbing, hands-off activities that are neither effective, nor inspiring them to keep security front-of-mind. Soulless video courses aren’t getting us there, token annual ‘tick-the-box’ events are a waste of time, and nobody is winning against the potential malicious threat actor waiting to jump on a small window of opportunity.
At this stage in our industry, we have worked out that contextual, hands-on education that is delivered in relevant programming languages and frameworks, with challenges that mimic those a developer might come across in the real world, is a far more engaging approach.
This is phase one of a developer’s quest to help AppSec gurus slay common vulnerabilities, but phase two is where scenarios must get real for a supercharged, security-aware defensive force.
Scaffolded learning is critical in adult education
When it comes to extracurricular courses or on-the-job training, it is often overlooked that adults bring with them a certain level of experience and existing knowledge. Good training adds to this foundation, and is structured in a way that allows for deeper understanding and faster autonomy in the learning process.
Scaffolded education is a potent, positive method of learning that seeks to activate and enhance prior experience, while continuing to build new skills - in manageable chunks - that allow the tutee to tackle increasingly difficult tasks with more confidence. Typically, it is a methodology best served with healthy portions of demonstration, visual aids, and student-led exploration.
If we tie this approach back to developer security training, it comes as no surprise that the dynamic, learn-by-doing method has long been preferred over the drudgery that is theory-based static learning. They are free to be the masters of their domain, and should see that their time is well spent.
In that sense, learning to code securely in a hyper-relevant, contextual environment is key, but the ‘level up’ from this step is to see an exploit of vulnerable code in action. With the context of frontend and backend views side-by-side, there is a tangible link between actions taken during the coding process, and what an attacker can potentially do with cut corners, misconfigurations, or accidents that are not caught and remedied.
Move from recall to application for a truly preventative security approach
Experiencing the impact of security vulnerabilities first-hand is a vital piece of the education puzzle, and it’s a fairly rare beast, even with the most modern security training options for developers. The foundational work spent on honing skills in spotting and remediating vulnerabilities, and recalling that experience to eliminate the same bugs in code as it is being written is extremely important, but it’s not the whole picture. To see how vulnerable code is exploited by a malicious actor adds a powerful layer of context, one that really drives home the importance of securing code, and applying hard-earned security knowledge to close every window of opportunity.
It is generally accepted that developers don’t love security, and they have even less affection for security training. Their experiences with AppSec specialists can be very frosty, and the rework caused by the security team bouncing vulnerable code back to developers for remediation is the bane of their existence. To an engineering team that is already spread thin, security is someone else’s problem, not their priority, and a hindrance to their natural creativity and primary objective of building features. However, there is simply too much code, too many breaches, and too much risk to the world’s data for this mindset to continue.
A functional DevSecOps process has developers working in harmony with security teams right at the beginning of the SDLC, and the opportunity for applied learning where they can interact with a simulated exploit, and see the impact of poorly secured code goes a long way in getting developers on the same page as those pesky AppSec people (who aren’t so bad after all).
Interactive learning prepares developers for the boss fight
At the time of writing, there were two major breaches reported in a 7-day period: Razer announced that over 100,000 sensitive data records had been exposed, while office supplies chain Staples also reported a similar data leak. Over a billion sensitive records have been exposed so far in 2020, and this worrying trend shows no signs of slowing down. Simply put, malicious actors have the upper hand, and security-aware developers are sorely needed to serve as the front line of defense.
Interactive challenges that focus on simulating such breaches move developers from passive recall, to applying skills that have an impact on the real boss fight: stopping attackers in their tracks.
Click on the link below and download the PDF of this resource.
Secure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.
View reportBook a demo
Matias Madou, Ph.D. is a security expert, researcher, and CTO and co-founder of Secure Code Warrior. Matias obtained his Ph.D. in Application Security from Ghent University, focusing on static analysis solutions. He later joined Fortify in the US, where he realized that it was insufficient to solely detect code problems without aiding developers in writing secure code. This inspired him to develop products that assist developers, alleviate the burden of security, and exceed customers' expectations. When he is not at his desk as part of Team Awesome, he enjoys being on stage presenting at conferences including RSA Conference, BlackHat and DefCon.
Matias is a researcher and developer with more than 15 years of hands-on software security experience. He has developed solutions for companies such as Fortify Software and his own company Sensei Security. Over his career, Matias has led multiple application security research projects which have led to commercial products and boasts over 10 patents under his belt. When he is away from his desk, Matias has served as an instructor for advanced application security training courses and regularly speaks at global conferences including RSA Conference, Black Hat, DefCon, BSIMM, OWASP AppSec and BruCon.
Matias holds a Ph.D. in Computer Engineering from Ghent University, where he studied application security through program obfuscation to hide the inner workings of an application.
A version of this article appeared in DevOps.com. It has been updated and syndicated here.
The playing field between the heroes and villains in cybersecurity is notoriously unfair. Sensitive data is the new gold, and attackers adapt quickly to circumvent defenses, exploiting security bugs large and small for potential paydirt.
The volume of code being produced is too great for security experts -- of increasing scarcity -- to contend with, and the rising cost of data breaches is proof that something has got to give. Fortunately, for the sake of our digital safety and the sanity of CISOs everywhere, the DevSecOps movement is helping to bring developers on the security journey from the beginning of the software development process. They are being recognized as the first line of defense against cyberattackers, with the power to eliminate common vulnerabilities at their fingertips.
However, their defensive capabilities are only as good as the training they receive, and that is yet another gauntlet for security teams to run. For many developers receiving training in secure coding on the job, their key challenge is staying awake during mind-numbing, hands-off activities that are neither effective, nor inspiring them to keep security front-of-mind. Soulless video courses aren’t getting us there, token annual ‘tick-the-box’ events are a waste of time, and nobody is winning against the potential malicious threat actor waiting to jump on a small window of opportunity.
At this stage in our industry, we have worked out that contextual, hands-on education that is delivered in relevant programming languages and frameworks, with challenges that mimic those a developer might come across in the real world, is a far more engaging approach.
This is phase one of a developer’s quest to help AppSec gurus slay common vulnerabilities, but phase two is where scenarios must get real for a supercharged, security-aware defensive force.
Scaffolded learning is critical in adult education
When it comes to extracurricular courses or on-the-job training, it is often overlooked that adults bring with them a certain level of experience and existing knowledge. Good training adds to this foundation, and is structured in a way that allows for deeper understanding and faster autonomy in the learning process.
Scaffolded education is a potent, positive method of learning that seeks to activate and enhance prior experience, while continuing to build new skills - in manageable chunks - that allow the tutee to tackle increasingly difficult tasks with more confidence. Typically, it is a methodology best served with healthy portions of demonstration, visual aids, and student-led exploration.
If we tie this approach back to developer security training, it comes as no surprise that the dynamic, learn-by-doing method has long been preferred over the drudgery that is theory-based static learning. They are free to be the masters of their domain, and should see that their time is well spent.
In that sense, learning to code securely in a hyper-relevant, contextual environment is key, but the ‘level up’ from this step is to see an exploit of vulnerable code in action. With the context of frontend and backend views side-by-side, there is a tangible link between actions taken during the coding process, and what an attacker can potentially do with cut corners, misconfigurations, or accidents that are not caught and remedied.
Move from recall to application for a truly preventative security approach
Experiencing the impact of security vulnerabilities first-hand is a vital piece of the education puzzle, and it’s a fairly rare beast, even with the most modern security training options for developers. The foundational work spent on honing skills in spotting and remediating vulnerabilities, and recalling that experience to eliminate the same bugs in code as it is being written is extremely important, but it’s not the whole picture. To see how vulnerable code is exploited by a malicious actor adds a powerful layer of context, one that really drives home the importance of securing code, and applying hard-earned security knowledge to close every window of opportunity.
It is generally accepted that developers don’t love security, and they have even less affection for security training. Their experiences with AppSec specialists can be very frosty, and the rework caused by the security team bouncing vulnerable code back to developers for remediation is the bane of their existence. To an engineering team that is already spread thin, security is someone else’s problem, not their priority, and a hindrance to their natural creativity and primary objective of building features. However, there is simply too much code, too many breaches, and too much risk to the world’s data for this mindset to continue.
A functional DevSecOps process has developers working in harmony with security teams right at the beginning of the SDLC, and the opportunity for applied learning where they can interact with a simulated exploit, and see the impact of poorly secured code goes a long way in getting developers on the same page as those pesky AppSec people (who aren’t so bad after all).
Interactive learning prepares developers for the boss fight
At the time of writing, there were two major breaches reported in a 7-day period: Razer announced that over 100,000 sensitive data records had been exposed, while office supplies chain Staples also reported a similar data leak. Over a billion sensitive records have been exposed so far in 2020, and this worrying trend shows no signs of slowing down. Simply put, malicious actors have the upper hand, and security-aware developers are sorely needed to serve as the front line of defense.
Interactive challenges that focus on simulating such breaches move developers from passive recall, to applying skills that have an impact on the real boss fight: stopping attackers in their tracks.
Table of contents
Matias Madou, Ph.D. is a security expert, researcher, and CTO and co-founder of Secure Code Warrior. Matias obtained his Ph.D. in Application Security from Ghent University, focusing on static analysis solutions. He later joined Fortify in the US, where he realized that it was insufficient to solely detect code problems without aiding developers in writing secure code. This inspired him to develop products that assist developers, alleviate the burden of security, and exceed customers' expectations. When he is not at his desk as part of Team Awesome, he enjoys being on stage presenting at conferences including RSA Conference, BlackHat and DefCon.
Secure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.
Book a demoDownloadResources to get you started
Benchmarking Security Skills: Streamlining Secure-by-Design in the Enterprise
The Secure-by-Design movement is the future of secure software development. Learn about the key elements companies need to keep in mind when they think about a Secure-by-Design initiative.
DigitalOcean Decreases Security Debt with Secure Code Warrior
DigitalOcean's use of Secure Code Warrior training has significantly reduced security debt, allowing teams to focus more on innovation and productivity. The improved security has strengthened their product quality and competitive edge. Looking ahead, the SCW Trust Score will help them further enhance security practices and continue driving innovation.
Resources to get you started
The Benefits of Benchmarking Security Skills for Developers
The growing focus on secure code and Secure-by-Design principles requires developers to be trained in cybersecurity from the start of the SDLC, with tools like Secure Code Warrior’s Trust Score helping measure and improve their progress.
Driving Meaningful Success for Enterprise Secure-by-Design Initiatives
Our latest research paper, Benchmarking Security Skills: Streamlining Secure-by-Design in the Enterprise is the result of deep analysis of real Secure-by-Design initiatives at the enterprise level, and deriving best practice approaches based on data-driven findings.
Deep Dive: Navigating the Critical CUPS Vulnerability in GNU-Linux Systems
Discover the latest security challenges facing Linux users as we explore recent high-severity vulnerabilities in the Common UNIX Printing System (CUPS). Learn how these issues may lead to potential Remote Code Execution (RCE) and what you can do to protect your systems.
Coders Conquer Security: Share & Learn - Cross-Site Scripting (XSS)
Cross-site scripting (XSS) uses the trust of browsers and ignorance of users to steal data, take over accounts, and deface websites; it's a vulnerability that can get very ugly, very quickly. Let's take a look at how XSS works, what damage can be done, and how to prevent it.
