How to roll out effective developer security training: 5 important lessons

Why does one developer application security training program produce better results than another?

Over my 10+ years as a SANS trainer and the last three years founding and building Secure Code Warrior (SCW), I have seen the value of investing time and resources into making training programs produce the best results.

In our first year of selling, our company engaged over 10,000 developers in secure code training, and I noticed a number of trends among those who had the most effective roll-out. Their results are heart-warming: great engagement, security awareness boost and strong ROI of the program by catching security weaknesses earlier before they become expensive.

I hate to admit it, but there have also been a few who took the "low-effort" approach and tried to roll out a program by sending an email with a link to the training. Not surprisingly, it doesn't fare as well and we had to correct these roll-outs.

Below, I am sharing what I believe are five important lessons that will significantly enhance the engagement levels, impact and success of any developer security training program, including ours.

1. Put some fun into the kick off if you want your program to have impact

Making a special kick-off day event, or giving your program a movie/geeky/gaming theme can make a big difference to the level of excitement and participation from the start. One of our large customers has created a whole fantasy program around a popular TV series, with t-shirts, badges and stickers, making the whole training program an experience no developer would want to miss. Another themed their event around Star Wars, held conveniently on the 4th of May. A bit of fun goes a long way to helping employees get on board, making short bursts of important developer secure code skills training feel like break from work, rather than another task that needs to be done. Milestone #1 achieve, we've got their attention and they know about the program.

2. Find the right developer security training champion (hint: they need communications skills more than security skills!)

Being able to find the right security champions in each scrum team is critical to ongoing program success, especially in larger organisations. In my experience, not all highly-skilled security or developer experts have highly developed people and/or communication skills. The best security champions, those who will give your program positive on-going impact, are those people who are passionate about security and have strong people, influencing and communication skills. Choose wisely and take personality and communication skills into account.

3. Have cool rewards that recognise skills

In general, every computer geek " including developers - like to be recognised for their intelligence and skills. When you reward them with specific status stickers, geeky gadgets, special badges or custom printed t-shirts that recognise their skills, they will wear or display them with pride. If someone achieves something significant in the training program, it is important to think of ways to give them recognition and exposure. I saw a great initiative with one customer who regularly took photos of their Secure Code Warrior champions and posted them alongside a photo and message from the company's CISO in the employee newsletter.

4. Don't try and make your developers into security experts

While you want to make your developers the "first line of defense" in your security program by helping them to code securely, that doesn't mean they need to be the most in-depth security experts in your business; or that you should continuously push new security vulnerabilities and data breach examples to them. While security is important, their primary objective is often building a great product or service and following the pace of the business. If you overload someone with too much security,  you run the risk of disengaging them. Key lessons learned, they need to understand basic security hygiene and support them with tools to code securely, but they don't need to be the company security expert.

5. Don't measure the training, measure the impact

Don't measure how many hours of training your developers take or how many videos they watch, measure the number of weaknesses that get picked up in the development life-cycle through code analysis, bug-bounties or classic vulnerability testing before your start the program in each team.  If your training program is working, the number of vulnerabilities being identified will go down. The second thing to measure is the time it takes to fix a vulnerability. If it takes a developer a month to fix it, this clearly shows they don't understand how to do it, but if they can fix it in an hour, you know they master the skills. These are the two metrics that clever companies are employing to measure the impact of their developer secure coding training.

5 important lessons on how to roll out effective developer security training:

1. Put some fun into the kick off if you want your program to have impact
2. Find the right developer security training champion (hint: they need communications skills more than security skills!)
3. Have cool rewards that recognise skills
4. Don't try and make your developers into security experts
5. Don't measure the training, measure the impact