Turning boring PCI-DSS compliance into a meaningful exercise for everybody: Part 2 - CISOs and developer awareness
This is part 2 of a mini-series on PCI-DSS compliance within an organization. In this final chapter, we detail how CTOs and CISOs can lead from the top in reducing cyber risk and making the process seamless, successful... and maybe a little fun for developers. (Did you miss part 1? Check it out here and learn how AppSec specialists can seize this opportunity for better security outcomes).
PCI-DSS best practice is undoubtedly a shared responsibility, but CISOs and CTOs can harness their considerable influence in crafting a thriving, positive security program from the top. They are the figurehead for cybersecurity trust and related sentiment with end-users, and a focus on awareness early has a powerful trickle-down effect, helping developers and AppSec professionals get the knowledge, tools and support they need to contribute to a robust security posture within the company.
Its important to stay compliant, but when everyone is on board with the "why", seeing results and being nurtured in the right way, a program can transcend legislation and become second-nature.
CTOs and CISOs have a role in creating mutual trust
Have you been on a site recently, and thought twice about handing over your credit card details? Unless it's the sketchy-looking web app powering the online ordering for your local pizza shop, this likely isn't something you experience very often, especially not with large corporations and household names in online retail.
Unless they disclose a data breach, of course.
Global accommodation giant, Marriott, just disclosed their second breach in the space of three years, with this one resulting in the theft of 5.2 million customer records. This time, it doesn't yet appear as though payment information was part of the heist, though their catastrophic breach in 2018 took care of that; 383 million customers were compromised, with 5 million unencrypted passport numbers stolen, as well as 8 million credit card numbers.
If customer trust in the Marriott brand wasn't already as low as it could get, I'd say it's close to hitting rock bottom soon. This is the sort of stuff that keeps CISOs awake at night, as they feel like sitting ducks in the war against cyber threats. Just look at Equifax, Yahoo, Sony, Target - these are just a few huge names that have endured large-scale breaches, representing billions of stolen data records, hundred of billions of dollars in damage, and customer-shaped holes punched right through their economic hearts. It's a disaster for the business (Target reported a $440 million profit plunge in the quarter following their 2014 breach), and while individual people aren't typically held responsible -- after all, software security should be a shared responsibility -- it's something you don't exactly want on an otherwise glowing resume if you happened to work for these organizations at the time.
Foregoing a robust security program to achieve compliance in an organization dealing with payments, sensitive data and the intangible gold that is positive customer sentiment, is an indicator of a company that is not only at-risk, but seriously lagging behind in innovation.
Everyone should care about trust issues in the customer/organization relationship.
Apart from the stress and calamity the IT, development, and security departments face after a breach, the trust factor is a major element in the long-term success of a newer company, or the continued growth of an established one. The obvious thing you stand to lose is your job, should the company be faced with an economic downturn as a result of lost faith.
The PCI-DSS regulations hold businesses accountable -- and as above, ignoring these well-laid plans has enormous implications -- but they're only as good as the security program that is put in place, and the people working within it. If you take them seriously, stay aware, and set an example for others, then you are setting yourself apart in a very positive way.
Awareness is everything.
A failing security awareness program is going to make most attempts to stay PCI-compliant close to useless. Organization-wide security awareness forms the most critical part of the best practice guidelines; they even offer their own training modules on how this can be implemented in cross-functional roles, and what this looks like in businesses who are doing it right.
As we move towards DevSecOps as the current gold standard in secure software development -- in which security as a shared responsibility is fundamental -- businesses must spend the time, money and effort to ensure everyone, including vendors and contractors, is security-aware and following best practices.
A security-aware developer is a compliant developer (and getting there doesn't have to be boring)
When it comes to becoming a "certified" compliant PCI-DSS developer, there aren't a whole lot of obvious options. Why? Probably because it cannot be a "one and done" exercise.
The OWASP organization is one of the best on the planet when it comes to learning how to thwart common vulnerabilities, and their Top 10 is formally listed in the PCI-DSS guidelines for developers. However, keeping security front-of-mind and honing skills takes time and continued effort. And nobody wants this to be uninspiring and a waste of effort.
A positive security culture is not a "nice to have" in an organization; if they're taking security seriously, then it needs to be part of the everyday running of the company.
Developers are on the front lines of battle when it comes to stopping vulnerabilities. Are they receiving the support, tools, and training to hold up their part of the security deal in PCI-DSS compliance?
The truth is, the right training is more seamless; it shouldn't feel like a lecture, and it should be highly relevant to the work being done every day. And this kind of hands-on training is an upskilling opportunity - a career move that only has positives for developers who are serious about stopping vulnerabilities and working with the rest of the team to produce a higher standard of code.
Want to test your secure coding skills right now? Choose your mission.
This is part 2 of a mini-series on PCI-DSS compliance within an organization. In this final chapter, we detail how CTOs and CISOs can lead from the top in reducing cyber risk and making the process seamless, successful... and maybe a little fun for developers.
Matias Madou, Ph.D. is a security expert, researcher, and CTO and co-founder of Secure Code Warrior. Matias obtained his Ph.D. in Application Security from Ghent University, focusing on static analysis solutions. He later joined Fortify in the US, where he realized that it was insufficient to solely detect code problems without aiding developers in writing secure code. This inspired him to develop products that assist developers, alleviate the burden of security, and exceed customers' expectations. When he is not at his desk as part of Team Awesome, he enjoys being on stage presenting at conferences including RSA Conference, BlackHat and DefCon.
Secure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.
Book a demo
Matias Madou, Ph.D. is a security expert, researcher, and CTO and co-founder of Secure Code Warrior. Matias obtained his Ph.D. in Application Security from Ghent University, focusing on static analysis solutions. He later joined Fortify in the US, where he realized that it was insufficient to solely detect code problems without aiding developers in writing secure code. This inspired him to develop products that assist developers, alleviate the burden of security, and exceed customers' expectations. When he is not at his desk as part of Team Awesome, he enjoys being on stage presenting at conferences including RSA Conference, BlackHat and DefCon.
Matias is a researcher and developer with more than 15 years of hands-on software security experience. He has developed solutions for companies such as Fortify Software and his own company Sensei Security. Over his career, Matias has led multiple application security research projects which have led to commercial products and boasts over 10 patents under his belt. When he is away from his desk, Matias has served as an instructor for advanced application security training courses and regularly speaks at global conferences including RSA Conference, Black Hat, DefCon, BSIMM, OWASP AppSec and BruCon.
Matias holds a Ph.D. in Computer Engineering from Ghent University, where he studied application security through program obfuscation to hide the inner workings of an application.
This is part 2 of a mini-series on PCI-DSS compliance within an organization. In this final chapter, we detail how CTOs and CISOs can lead from the top in reducing cyber risk and making the process seamless, successful... and maybe a little fun for developers. (Did you miss part 1? Check it out here and learn how AppSec specialists can seize this opportunity for better security outcomes).
PCI-DSS best practice is undoubtedly a shared responsibility, but CISOs and CTOs can harness their considerable influence in crafting a thriving, positive security program from the top. They are the figurehead for cybersecurity trust and related sentiment with end-users, and a focus on awareness early has a powerful trickle-down effect, helping developers and AppSec professionals get the knowledge, tools and support they need to contribute to a robust security posture within the company.
Its important to stay compliant, but when everyone is on board with the "why", seeing results and being nurtured in the right way, a program can transcend legislation and become second-nature.
CTOs and CISOs have a role in creating mutual trust
Have you been on a site recently, and thought twice about handing over your credit card details? Unless it's the sketchy-looking web app powering the online ordering for your local pizza shop, this likely isn't something you experience very often, especially not with large corporations and household names in online retail.
Unless they disclose a data breach, of course.
Global accommodation giant, Marriott, just disclosed their second breach in the space of three years, with this one resulting in the theft of 5.2 million customer records. This time, it doesn't yet appear as though payment information was part of the heist, though their catastrophic breach in 2018 took care of that; 383 million customers were compromised, with 5 million unencrypted passport numbers stolen, as well as 8 million credit card numbers.
If customer trust in the Marriott brand wasn't already as low as it could get, I'd say it's close to hitting rock bottom soon. This is the sort of stuff that keeps CISOs awake at night, as they feel like sitting ducks in the war against cyber threats. Just look at Equifax, Yahoo, Sony, Target - these are just a few huge names that have endured large-scale breaches, representing billions of stolen data records, hundred of billions of dollars in damage, and customer-shaped holes punched right through their economic hearts. It's a disaster for the business (Target reported a $440 million profit plunge in the quarter following their 2014 breach), and while individual people aren't typically held responsible -- after all, software security should be a shared responsibility -- it's something you don't exactly want on an otherwise glowing resume if you happened to work for these organizations at the time.
Foregoing a robust security program to achieve compliance in an organization dealing with payments, sensitive data and the intangible gold that is positive customer sentiment, is an indicator of a company that is not only at-risk, but seriously lagging behind in innovation.
Everyone should care about trust issues in the customer/organization relationship.
Apart from the stress and calamity the IT, development, and security departments face after a breach, the trust factor is a major element in the long-term success of a newer company, or the continued growth of an established one. The obvious thing you stand to lose is your job, should the company be faced with an economic downturn as a result of lost faith.
The PCI-DSS regulations hold businesses accountable -- and as above, ignoring these well-laid plans has enormous implications -- but they're only as good as the security program that is put in place, and the people working within it. If you take them seriously, stay aware, and set an example for others, then you are setting yourself apart in a very positive way.
Awareness is everything.
A failing security awareness program is going to make most attempts to stay PCI-compliant close to useless. Organization-wide security awareness forms the most critical part of the best practice guidelines; they even offer their own training modules on how this can be implemented in cross-functional roles, and what this looks like in businesses who are doing it right.
As we move towards DevSecOps as the current gold standard in secure software development -- in which security as a shared responsibility is fundamental -- businesses must spend the time, money and effort to ensure everyone, including vendors and contractors, is security-aware and following best practices.
A security-aware developer is a compliant developer (and getting there doesn't have to be boring)
When it comes to becoming a "certified" compliant PCI-DSS developer, there aren't a whole lot of obvious options. Why? Probably because it cannot be a "one and done" exercise.
The OWASP organization is one of the best on the planet when it comes to learning how to thwart common vulnerabilities, and their Top 10 is formally listed in the PCI-DSS guidelines for developers. However, keeping security front-of-mind and honing skills takes time and continued effort. And nobody wants this to be uninspiring and a waste of effort.
A positive security culture is not a "nice to have" in an organization; if they're taking security seriously, then it needs to be part of the everyday running of the company.
Developers are on the front lines of battle when it comes to stopping vulnerabilities. Are they receiving the support, tools, and training to hold up their part of the security deal in PCI-DSS compliance?
The truth is, the right training is more seamless; it shouldn't feel like a lecture, and it should be highly relevant to the work being done every day. And this kind of hands-on training is an upskilling opportunity - a career move that only has positives for developers who are serious about stopping vulnerabilities and working with the rest of the team to produce a higher standard of code.
Want to test your secure coding skills right now? Choose your mission.
This is part 2 of a mini-series on PCI-DSS compliance within an organization. In this final chapter, we detail how CTOs and CISOs can lead from the top in reducing cyber risk and making the process seamless, successful... and maybe a little fun for developers. (Did you miss part 1? Check it out here and learn how AppSec specialists can seize this opportunity for better security outcomes).
PCI-DSS best practice is undoubtedly a shared responsibility, but CISOs and CTOs can harness their considerable influence in crafting a thriving, positive security program from the top. They are the figurehead for cybersecurity trust and related sentiment with end-users, and a focus on awareness early has a powerful trickle-down effect, helping developers and AppSec professionals get the knowledge, tools and support they need to contribute to a robust security posture within the company.
Its important to stay compliant, but when everyone is on board with the "why", seeing results and being nurtured in the right way, a program can transcend legislation and become second-nature.
CTOs and CISOs have a role in creating mutual trust
Have you been on a site recently, and thought twice about handing over your credit card details? Unless it's the sketchy-looking web app powering the online ordering for your local pizza shop, this likely isn't something you experience very often, especially not with large corporations and household names in online retail.
Unless they disclose a data breach, of course.
Global accommodation giant, Marriott, just disclosed their second breach in the space of three years, with this one resulting in the theft of 5.2 million customer records. This time, it doesn't yet appear as though payment information was part of the heist, though their catastrophic breach in 2018 took care of that; 383 million customers were compromised, with 5 million unencrypted passport numbers stolen, as well as 8 million credit card numbers.
If customer trust in the Marriott brand wasn't already as low as it could get, I'd say it's close to hitting rock bottom soon. This is the sort of stuff that keeps CISOs awake at night, as they feel like sitting ducks in the war against cyber threats. Just look at Equifax, Yahoo, Sony, Target - these are just a few huge names that have endured large-scale breaches, representing billions of stolen data records, hundred of billions of dollars in damage, and customer-shaped holes punched right through their economic hearts. It's a disaster for the business (Target reported a $440 million profit plunge in the quarter following their 2014 breach), and while individual people aren't typically held responsible -- after all, software security should be a shared responsibility -- it's something you don't exactly want on an otherwise glowing resume if you happened to work for these organizations at the time.
Foregoing a robust security program to achieve compliance in an organization dealing with payments, sensitive data and the intangible gold that is positive customer sentiment, is an indicator of a company that is not only at-risk, but seriously lagging behind in innovation.
Everyone should care about trust issues in the customer/organization relationship.
Apart from the stress and calamity the IT, development, and security departments face after a breach, the trust factor is a major element in the long-term success of a newer company, or the continued growth of an established one. The obvious thing you stand to lose is your job, should the company be faced with an economic downturn as a result of lost faith.
The PCI-DSS regulations hold businesses accountable -- and as above, ignoring these well-laid plans has enormous implications -- but they're only as good as the security program that is put in place, and the people working within it. If you take them seriously, stay aware, and set an example for others, then you are setting yourself apart in a very positive way.
Awareness is everything.
A failing security awareness program is going to make most attempts to stay PCI-compliant close to useless. Organization-wide security awareness forms the most critical part of the best practice guidelines; they even offer their own training modules on how this can be implemented in cross-functional roles, and what this looks like in businesses who are doing it right.
As we move towards DevSecOps as the current gold standard in secure software development -- in which security as a shared responsibility is fundamental -- businesses must spend the time, money and effort to ensure everyone, including vendors and contractors, is security-aware and following best practices.
A security-aware developer is a compliant developer (and getting there doesn't have to be boring)
When it comes to becoming a "certified" compliant PCI-DSS developer, there aren't a whole lot of obvious options. Why? Probably because it cannot be a "one and done" exercise.
The OWASP organization is one of the best on the planet when it comes to learning how to thwart common vulnerabilities, and their Top 10 is formally listed in the PCI-DSS guidelines for developers. However, keeping security front-of-mind and honing skills takes time and continued effort. And nobody wants this to be uninspiring and a waste of effort.
A positive security culture is not a "nice to have" in an organization; if they're taking security seriously, then it needs to be part of the everyday running of the company.
Developers are on the front lines of battle when it comes to stopping vulnerabilities. Are they receiving the support, tools, and training to hold up their part of the security deal in PCI-DSS compliance?
The truth is, the right training is more seamless; it shouldn't feel like a lecture, and it should be highly relevant to the work being done every day. And this kind of hands-on training is an upskilling opportunity - a career move that only has positives for developers who are serious about stopping vulnerabilities and working with the rest of the team to produce a higher standard of code.
Want to test your secure coding skills right now? Choose your mission.
Click on the link below and download the PDF of this resource.
Secure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.
View reportBook a demo
Matias Madou, Ph.D. is a security expert, researcher, and CTO and co-founder of Secure Code Warrior. Matias obtained his Ph.D. in Application Security from Ghent University, focusing on static analysis solutions. He later joined Fortify in the US, where he realized that it was insufficient to solely detect code problems without aiding developers in writing secure code. This inspired him to develop products that assist developers, alleviate the burden of security, and exceed customers' expectations. When he is not at his desk as part of Team Awesome, he enjoys being on stage presenting at conferences including RSA Conference, BlackHat and DefCon.
Matias is a researcher and developer with more than 15 years of hands-on software security experience. He has developed solutions for companies such as Fortify Software and his own company Sensei Security. Over his career, Matias has led multiple application security research projects which have led to commercial products and boasts over 10 patents under his belt. When he is away from his desk, Matias has served as an instructor for advanced application security training courses and regularly speaks at global conferences including RSA Conference, Black Hat, DefCon, BSIMM, OWASP AppSec and BruCon.
Matias holds a Ph.D. in Computer Engineering from Ghent University, where he studied application security through program obfuscation to hide the inner workings of an application.
This is part 2 of a mini-series on PCI-DSS compliance within an organization. In this final chapter, we detail how CTOs and CISOs can lead from the top in reducing cyber risk and making the process seamless, successful... and maybe a little fun for developers. (Did you miss part 1? Check it out here and learn how AppSec specialists can seize this opportunity for better security outcomes).
PCI-DSS best practice is undoubtedly a shared responsibility, but CISOs and CTOs can harness their considerable influence in crafting a thriving, positive security program from the top. They are the figurehead for cybersecurity trust and related sentiment with end-users, and a focus on awareness early has a powerful trickle-down effect, helping developers and AppSec professionals get the knowledge, tools and support they need to contribute to a robust security posture within the company.
Its important to stay compliant, but when everyone is on board with the "why", seeing results and being nurtured in the right way, a program can transcend legislation and become second-nature.
CTOs and CISOs have a role in creating mutual trust
Have you been on a site recently, and thought twice about handing over your credit card details? Unless it's the sketchy-looking web app powering the online ordering for your local pizza shop, this likely isn't something you experience very often, especially not with large corporations and household names in online retail.
Unless they disclose a data breach, of course.
Global accommodation giant, Marriott, just disclosed their second breach in the space of three years, with this one resulting in the theft of 5.2 million customer records. This time, it doesn't yet appear as though payment information was part of the heist, though their catastrophic breach in 2018 took care of that; 383 million customers were compromised, with 5 million unencrypted passport numbers stolen, as well as 8 million credit card numbers.
If customer trust in the Marriott brand wasn't already as low as it could get, I'd say it's close to hitting rock bottom soon. This is the sort of stuff that keeps CISOs awake at night, as they feel like sitting ducks in the war against cyber threats. Just look at Equifax, Yahoo, Sony, Target - these are just a few huge names that have endured large-scale breaches, representing billions of stolen data records, hundred of billions of dollars in damage, and customer-shaped holes punched right through their economic hearts. It's a disaster for the business (Target reported a $440 million profit plunge in the quarter following their 2014 breach), and while individual people aren't typically held responsible -- after all, software security should be a shared responsibility -- it's something you don't exactly want on an otherwise glowing resume if you happened to work for these organizations at the time.
Foregoing a robust security program to achieve compliance in an organization dealing with payments, sensitive data and the intangible gold that is positive customer sentiment, is an indicator of a company that is not only at-risk, but seriously lagging behind in innovation.
Everyone should care about trust issues in the customer/organization relationship.
Apart from the stress and calamity the IT, development, and security departments face after a breach, the trust factor is a major element in the long-term success of a newer company, or the continued growth of an established one. The obvious thing you stand to lose is your job, should the company be faced with an economic downturn as a result of lost faith.
The PCI-DSS regulations hold businesses accountable -- and as above, ignoring these well-laid plans has enormous implications -- but they're only as good as the security program that is put in place, and the people working within it. If you take them seriously, stay aware, and set an example for others, then you are setting yourself apart in a very positive way.
Awareness is everything.
A failing security awareness program is going to make most attempts to stay PCI-compliant close to useless. Organization-wide security awareness forms the most critical part of the best practice guidelines; they even offer their own training modules on how this can be implemented in cross-functional roles, and what this looks like in businesses who are doing it right.
As we move towards DevSecOps as the current gold standard in secure software development -- in which security as a shared responsibility is fundamental -- businesses must spend the time, money and effort to ensure everyone, including vendors and contractors, is security-aware and following best practices.
A security-aware developer is a compliant developer (and getting there doesn't have to be boring)
When it comes to becoming a "certified" compliant PCI-DSS developer, there aren't a whole lot of obvious options. Why? Probably because it cannot be a "one and done" exercise.
The OWASP organization is one of the best on the planet when it comes to learning how to thwart common vulnerabilities, and their Top 10 is formally listed in the PCI-DSS guidelines for developers. However, keeping security front-of-mind and honing skills takes time and continued effort. And nobody wants this to be uninspiring and a waste of effort.
A positive security culture is not a "nice to have" in an organization; if they're taking security seriously, then it needs to be part of the everyday running of the company.
Developers are on the front lines of battle when it comes to stopping vulnerabilities. Are they receiving the support, tools, and training to hold up their part of the security deal in PCI-DSS compliance?
The truth is, the right training is more seamless; it shouldn't feel like a lecture, and it should be highly relevant to the work being done every day. And this kind of hands-on training is an upskilling opportunity - a career move that only has positives for developers who are serious about stopping vulnerabilities and working with the rest of the team to produce a higher standard of code.
Want to test your secure coding skills right now? Choose your mission.
Table of contents
Matias Madou, Ph.D. is a security expert, researcher, and CTO and co-founder of Secure Code Warrior. Matias obtained his Ph.D. in Application Security from Ghent University, focusing on static analysis solutions. He later joined Fortify in the US, where he realized that it was insufficient to solely detect code problems without aiding developers in writing secure code. This inspired him to develop products that assist developers, alleviate the burden of security, and exceed customers' expectations. When he is not at his desk as part of Team Awesome, he enjoys being on stage presenting at conferences including RSA Conference, BlackHat and DefCon.
Secure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.
Book a demoDownloadResources to get you started
Professional Services - Accelerate with expertise
Secure Code Warrior’s Program Strategy Services (PSS) team helps you build, enhance, and optimize your secure coding program. Whether you're starting fresh or refining your approach, our experts provide tailored guidance.
Secure code training topics & content
Our industry-leading content is always evolving to fit the ever changing software development landscape with your role in mind. Topics covering everything from AI to XQuery Injection, offered for a variety of roles from Architects and Engineers to Product Managers and QA. Get a sneak peak of what our content catalog has to offer by topic and role.
Quests: Industry leading learning to keep developers ahead of the game mitigating risk.
Quests is a learning platform that helps developers mitigate software security risks by enhancing their secure coding skills. With curated learning paths, hands-on challenges, and interactive activities, it empowers developers to identify and prevent vulnerabilities.
Resources to get you started
The Decade of the Defenders: Secure Code Warrior Turns Ten
Secure Code Warrior's founding team has stayed together, steering the ship through every lesson, triumph, and setback for an entire decade. We’re scaling up and ready to face our next chapter, SCW 2.0, as the leaders in developer risk management.
10 Key Predictions: Secure Code Warrior on AI & Secure-by-Design’s Influence in 2025
Organizations are facing tough decisions on AI usage to support long-term productivity, sustainability, and security ROI. It’s become clear to us over the last few years that AI will never fully replace the role of the developer. From AI + developer partnerships to the increasing pressures (and confusion) around Secure-by-Design expectations, let’s take a closer look at what we can expect over the next year.
Developer-driven coding.
Securely.
Contact us today and make software security an intrinsic part of your development process.
