Turning boring PCI-DSS compliance into a meaningful exercise for everybody: Part 2 - CISOs and developer awareness
This is part 2 of a mini-series on PCI-DSS compliance within an organization. In this final chapter, we detail how CTOs and CISOs can lead from the top in reducing cyber risk and making the process seamless, successful... and maybe a little fun for developers. (Did you miss part 1? Check it out here and learn how AppSec specialists can seize this opportunity for better security outcomes).
PCI-DSS best practice is undoubtedly a shared responsibility, but CISOs and CTOs can harness their considerable influence in crafting a thriving, positive security program from the top. They are the figurehead for cybersecurity trust and related sentiment with end-users, and a focus on awareness early has a powerful trickle-down effect, helping developers and AppSec professionals get the knowledge, tools and support they need to contribute to a robust security posture within the company.
Its important to stay compliant, but when everyone is on board with the "why", seeing results and being nurtured in the right way, a program can transcend legislation and become second-nature.
CTOs and CISOs have a role in creating mutual trust
Have you been on a site recently, and thought twice about handing over your credit card details? Unless it's the sketchy-looking web app powering the online ordering for your local pizza shop, this likely isn't something you experience very often, especially not with large corporations and household names in online retail.
Unless they disclose a data breach, of course.
Global accommodation giant, Marriott, just disclosed their second breach in the space of three years, with this one resulting in the theft of 5.2 million customer records. This time, it doesn't yet appear as though payment information was part of the heist, though their catastrophic breach in 2018 took care of that; 383 million customers were compromised, with 5 million unencrypted passport numbers stolen, as well as 8 million credit card numbers.
If customer trust in the Marriott brand wasn't already as low as it could get, I'd say it's close to hitting rock bottom soon. This is the sort of stuff that keeps CISOs awake at night, as they feel like sitting ducks in the war against cyber threats. Just look at Equifax, Yahoo, Sony, Target - these are just a few huge names that have endured large-scale breaches, representing billions of stolen data records, hundred of billions of dollars in damage, and customer-shaped holes punched right through their economic hearts. It's a disaster for the business (Target reported a $440 million profit plunge in the quarter following their 2014 breach), and while individual people aren't typically held responsible -- after all, software security should be a shared responsibility -- it's something you don't exactly want on an otherwise glowing resume if you happened to work for these organizations at the time.
Foregoing a robust security program to achieve compliance in an organization dealing with payments, sensitive data and the intangible gold that is positive customer sentiment, is an indicator of a company that is not only at-risk, but seriously lagging behind in innovation.
Everyone should care about trust issues in the customer/organization relationship.
Apart from the stress and calamity the IT, development, and security departments face after a breach, the trust factor is a major element in the long-term success of a newer company, or the continued growth of an established one. The obvious thing you stand to lose is your job, should the company be faced with an economic downturn as a result of lost faith.
The PCI-DSS regulations hold businesses accountable -- and as above, ignoring these well-laid plans has enormous implications -- but they're only as good as the security program that is put in place, and the people working within it. If you take them seriously, stay aware, and set an example for others, then you are setting yourself apart in a very positive way.
Awareness is everything.
A failing security awareness program is going to make most attempts to stay PCI-compliant close to useless. Organization-wide security awareness forms the most critical part of the best practice guidelines; they even offer their own training modules on how this can be implemented in cross-functional roles, and what this looks like in businesses who are doing it right.
As we move towards DevSecOps as the current gold standard in secure software development -- in which security as a shared responsibility is fundamental -- businesses must spend the time, money and effort to ensure everyone, including vendors and contractors, is security-aware and following best practices.
A security-aware developer is a compliant developer (and getting there doesn't have to be boring)
When it comes to becoming a "certified" compliant PCI-DSS developer, there aren't a whole lot of obvious options. Why? Probably because it cannot be a "one and done" exercise.
The OWASP organization is one of the best on the planet when it comes to learning how to thwart common vulnerabilities, and their Top 10 is formally listed in the PCI-DSS guidelines for developers. However, keeping security front-of-mind and honing skills takes time and continued effort. And nobody wants this to be uninspiring and a waste of effort.
A positive security culture is not a "nice to have" in an organization; if they're taking security seriously, then it needs to be part of the everyday running of the company.
Developers are on the front lines of battle when it comes to stopping vulnerabilities. Are they receiving the support, tools, and training to hold up their part of the security deal in PCI-DSS compliance?
The truth is, the right training is more seamless; it shouldn't feel like a lecture, and it should be highly relevant to the work being done every day. And this kind of hands-on training is an upskilling opportunity - a career move that only has positives for developers who are serious about stopping vulnerabilities and working with the rest of the team to produce a higher standard of code.
Want to test your secure coding skills right now? Choose your mission.
This is part 2 of a mini-series on PCI-DSS compliance within an organization. In this final chapter, we detail how CTOs and CISOs can lead from the top in reducing cyber risk and making the process seamless, successful... and maybe a little fun for developers.
Matias Madou, Ph.D. is a security expert, researcher, and CTO and co-founder of Secure Code Warrior. Matias obtained his Ph.D. in Application Security from Ghent University, focusing on static analysis solutions. He later joined Fortify in the US, where he realized that it was insufficient to solely detect code problems without aiding developers in writing secure code. This inspired him to develop products that assist developers, alleviate the burden of security, and exceed customers' expectations. When he is not at his desk as part of Team Awesome, he enjoys being on stage presenting at conferences including RSA Conference, BlackHat and DefCon.
Secure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.
Book a demo
Matias Madou, Ph.D. is a security expert, researcher, and CTO and co-founder of Secure Code Warrior. Matias obtained his Ph.D. in Application Security from Ghent University, focusing on static analysis solutions. He later joined Fortify in the US, where he realized that it was insufficient to solely detect code problems without aiding developers in writing secure code. This inspired him to develop products that assist developers, alleviate the burden of security, and exceed customers' expectations. When he is not at his desk as part of Team Awesome, he enjoys being on stage presenting at conferences including RSA Conference, BlackHat and DefCon.
Matias is a researcher and developer with more than 15 years of hands-on software security experience. He has developed solutions for companies such as Fortify Software and his own company Sensei Security. Over his career, Matias has led multiple application security research projects which have led to commercial products and boasts over 10 patents under his belt. When he is away from his desk, Matias has served as an instructor for advanced application security training courses and regularly speaks at global conferences including RSA Conference, Black Hat, DefCon, BSIMM, OWASP AppSec and BruCon.
Matias holds a Ph.D. in Computer Engineering from Ghent University, where he studied application security through program obfuscation to hide the inner workings of an application.
This is part 2 of a mini-series on PCI-DSS compliance within an organization. In this final chapter, we detail how CTOs and CISOs can lead from the top in reducing cyber risk and making the process seamless, successful... and maybe a little fun for developers. (Did you miss part 1? Check it out here and learn how AppSec specialists can seize this opportunity for better security outcomes).
PCI-DSS best practice is undoubtedly a shared responsibility, but CISOs and CTOs can harness their considerable influence in crafting a thriving, positive security program from the top. They are the figurehead for cybersecurity trust and related sentiment with end-users, and a focus on awareness early has a powerful trickle-down effect, helping developers and AppSec professionals get the knowledge, tools and support they need to contribute to a robust security posture within the company.
Its important to stay compliant, but when everyone is on board with the "why", seeing results and being nurtured in the right way, a program can transcend legislation and become second-nature.
CTOs and CISOs have a role in creating mutual trust
Have you been on a site recently, and thought twice about handing over your credit card details? Unless it's the sketchy-looking web app powering the online ordering for your local pizza shop, this likely isn't something you experience very often, especially not with large corporations and household names in online retail.
Unless they disclose a data breach, of course.
Global accommodation giant, Marriott, just disclosed their second breach in the space of three years, with this one resulting in the theft of 5.2 million customer records. This time, it doesn't yet appear as though payment information was part of the heist, though their catastrophic breach in 2018 took care of that; 383 million customers were compromised, with 5 million unencrypted passport numbers stolen, as well as 8 million credit card numbers.
If customer trust in the Marriott brand wasn't already as low as it could get, I'd say it's close to hitting rock bottom soon. This is the sort of stuff that keeps CISOs awake at night, as they feel like sitting ducks in the war against cyber threats. Just look at Equifax, Yahoo, Sony, Target - these are just a few huge names that have endured large-scale breaches, representing billions of stolen data records, hundred of billions of dollars in damage, and customer-shaped holes punched right through their economic hearts. It's a disaster for the business (Target reported a $440 million profit plunge in the quarter following their 2014 breach), and while individual people aren't typically held responsible -- after all, software security should be a shared responsibility -- it's something you don't exactly want on an otherwise glowing resume if you happened to work for these organizations at the time.
Foregoing a robust security program to achieve compliance in an organization dealing with payments, sensitive data and the intangible gold that is positive customer sentiment, is an indicator of a company that is not only at-risk, but seriously lagging behind in innovation.
Everyone should care about trust issues in the customer/organization relationship.
Apart from the stress and calamity the IT, development, and security departments face after a breach, the trust factor is a major element in the long-term success of a newer company, or the continued growth of an established one. The obvious thing you stand to lose is your job, should the company be faced with an economic downturn as a result of lost faith.
The PCI-DSS regulations hold businesses accountable -- and as above, ignoring these well-laid plans has enormous implications -- but they're only as good as the security program that is put in place, and the people working within it. If you take them seriously, stay aware, and set an example for others, then you are setting yourself apart in a very positive way.
Awareness is everything.
A failing security awareness program is going to make most attempts to stay PCI-compliant close to useless. Organization-wide security awareness forms the most critical part of the best practice guidelines; they even offer their own training modules on how this can be implemented in cross-functional roles, and what this looks like in businesses who are doing it right.
As we move towards DevSecOps as the current gold standard in secure software development -- in which security as a shared responsibility is fundamental -- businesses must spend the time, money and effort to ensure everyone, including vendors and contractors, is security-aware and following best practices.
A security-aware developer is a compliant developer (and getting there doesn't have to be boring)
When it comes to becoming a "certified" compliant PCI-DSS developer, there aren't a whole lot of obvious options. Why? Probably because it cannot be a "one and done" exercise.
The OWASP organization is one of the best on the planet when it comes to learning how to thwart common vulnerabilities, and their Top 10 is formally listed in the PCI-DSS guidelines for developers. However, keeping security front-of-mind and honing skills takes time and continued effort. And nobody wants this to be uninspiring and a waste of effort.
A positive security culture is not a "nice to have" in an organization; if they're taking security seriously, then it needs to be part of the everyday running of the company.
Developers are on the front lines of battle when it comes to stopping vulnerabilities. Are they receiving the support, tools, and training to hold up their part of the security deal in PCI-DSS compliance?
The truth is, the right training is more seamless; it shouldn't feel like a lecture, and it should be highly relevant to the work being done every day. And this kind of hands-on training is an upskilling opportunity - a career move that only has positives for developers who are serious about stopping vulnerabilities and working with the rest of the team to produce a higher standard of code.
Want to test your secure coding skills right now? Choose your mission.
This is part 2 of a mini-series on PCI-DSS compliance within an organization. In this final chapter, we detail how CTOs and CISOs can lead from the top in reducing cyber risk and making the process seamless, successful... and maybe a little fun for developers. (Did you miss part 1? Check it out here and learn how AppSec specialists can seize this opportunity for better security outcomes).
PCI-DSS best practice is undoubtedly a shared responsibility, but CISOs and CTOs can harness their considerable influence in crafting a thriving, positive security program from the top. They are the figurehead for cybersecurity trust and related sentiment with end-users, and a focus on awareness early has a powerful trickle-down effect, helping developers and AppSec professionals get the knowledge, tools and support they need to contribute to a robust security posture within the company.
Its important to stay compliant, but when everyone is on board with the "why", seeing results and being nurtured in the right way, a program can transcend legislation and become second-nature.
CTOs and CISOs have a role in creating mutual trust
Have you been on a site recently, and thought twice about handing over your credit card details? Unless it's the sketchy-looking web app powering the online ordering for your local pizza shop, this likely isn't something you experience very often, especially not with large corporations and household names in online retail.
Unless they disclose a data breach, of course.
Global accommodation giant, Marriott, just disclosed their second breach in the space of three years, with this one resulting in the theft of 5.2 million customer records. This time, it doesn't yet appear as though payment information was part of the heist, though their catastrophic breach in 2018 took care of that; 383 million customers were compromised, with 5 million unencrypted passport numbers stolen, as well as 8 million credit card numbers.
If customer trust in the Marriott brand wasn't already as low as it could get, I'd say it's close to hitting rock bottom soon. This is the sort of stuff that keeps CISOs awake at night, as they feel like sitting ducks in the war against cyber threats. Just look at Equifax, Yahoo, Sony, Target - these are just a few huge names that have endured large-scale breaches, representing billions of stolen data records, hundred of billions of dollars in damage, and customer-shaped holes punched right through their economic hearts. It's a disaster for the business (Target reported a $440 million profit plunge in the quarter following their 2014 breach), and while individual people aren't typically held responsible -- after all, software security should be a shared responsibility -- it's something you don't exactly want on an otherwise glowing resume if you happened to work for these organizations at the time.
Foregoing a robust security program to achieve compliance in an organization dealing with payments, sensitive data and the intangible gold that is positive customer sentiment, is an indicator of a company that is not only at-risk, but seriously lagging behind in innovation.
Everyone should care about trust issues in the customer/organization relationship.
Apart from the stress and calamity the IT, development, and security departments face after a breach, the trust factor is a major element in the long-term success of a newer company, or the continued growth of an established one. The obvious thing you stand to lose is your job, should the company be faced with an economic downturn as a result of lost faith.
The PCI-DSS regulations hold businesses accountable -- and as above, ignoring these well-laid plans has enormous implications -- but they're only as good as the security program that is put in place, and the people working within it. If you take them seriously, stay aware, and set an example for others, then you are setting yourself apart in a very positive way.
Awareness is everything.
A failing security awareness program is going to make most attempts to stay PCI-compliant close to useless. Organization-wide security awareness forms the most critical part of the best practice guidelines; they even offer their own training modules on how this can be implemented in cross-functional roles, and what this looks like in businesses who are doing it right.
As we move towards DevSecOps as the current gold standard in secure software development -- in which security as a shared responsibility is fundamental -- businesses must spend the time, money and effort to ensure everyone, including vendors and contractors, is security-aware and following best practices.
A security-aware developer is a compliant developer (and getting there doesn't have to be boring)
When it comes to becoming a "certified" compliant PCI-DSS developer, there aren't a whole lot of obvious options. Why? Probably because it cannot be a "one and done" exercise.
The OWASP organization is one of the best on the planet when it comes to learning how to thwart common vulnerabilities, and their Top 10 is formally listed in the PCI-DSS guidelines for developers. However, keeping security front-of-mind and honing skills takes time and continued effort. And nobody wants this to be uninspiring and a waste of effort.
A positive security culture is not a "nice to have" in an organization; if they're taking security seriously, then it needs to be part of the everyday running of the company.
Developers are on the front lines of battle when it comes to stopping vulnerabilities. Are they receiving the support, tools, and training to hold up their part of the security deal in PCI-DSS compliance?
The truth is, the right training is more seamless; it shouldn't feel like a lecture, and it should be highly relevant to the work being done every day. And this kind of hands-on training is an upskilling opportunity - a career move that only has positives for developers who are serious about stopping vulnerabilities and working with the rest of the team to produce a higher standard of code.
Want to test your secure coding skills right now? Choose your mission.
Click on the link below and download the PDF of this resource.
Secure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.
View reportBook a demo
Matias Madou, Ph.D. is a security expert, researcher, and CTO and co-founder of Secure Code Warrior. Matias obtained his Ph.D. in Application Security from Ghent University, focusing on static analysis solutions. He later joined Fortify in the US, where he realized that it was insufficient to solely detect code problems without aiding developers in writing secure code. This inspired him to develop products that assist developers, alleviate the burden of security, and exceed customers' expectations. When he is not at his desk as part of Team Awesome, he enjoys being on stage presenting at conferences including RSA Conference, BlackHat and DefCon.
Matias is a researcher and developer with more than 15 years of hands-on software security experience. He has developed solutions for companies such as Fortify Software and his own company Sensei Security. Over his career, Matias has led multiple application security research projects which have led to commercial products and boasts over 10 patents under his belt. When he is away from his desk, Matias has served as an instructor for advanced application security training courses and regularly speaks at global conferences including RSA Conference, Black Hat, DefCon, BSIMM, OWASP AppSec and BruCon.
Matias holds a Ph.D. in Computer Engineering from Ghent University, where he studied application security through program obfuscation to hide the inner workings of an application.
This is part 2 of a mini-series on PCI-DSS compliance within an organization. In this final chapter, we detail how CTOs and CISOs can lead from the top in reducing cyber risk and making the process seamless, successful... and maybe a little fun for developers. (Did you miss part 1? Check it out here and learn how AppSec specialists can seize this opportunity for better security outcomes).
PCI-DSS best practice is undoubtedly a shared responsibility, but CISOs and CTOs can harness their considerable influence in crafting a thriving, positive security program from the top. They are the figurehead for cybersecurity trust and related sentiment with end-users, and a focus on awareness early has a powerful trickle-down effect, helping developers and AppSec professionals get the knowledge, tools and support they need to contribute to a robust security posture within the company.
Its important to stay compliant, but when everyone is on board with the "why", seeing results and being nurtured in the right way, a program can transcend legislation and become second-nature.
CTOs and CISOs have a role in creating mutual trust
Have you been on a site recently, and thought twice about handing over your credit card details? Unless it's the sketchy-looking web app powering the online ordering for your local pizza shop, this likely isn't something you experience very often, especially not with large corporations and household names in online retail.
Unless they disclose a data breach, of course.
Global accommodation giant, Marriott, just disclosed their second breach in the space of three years, with this one resulting in the theft of 5.2 million customer records. This time, it doesn't yet appear as though payment information was part of the heist, though their catastrophic breach in 2018 took care of that; 383 million customers were compromised, with 5 million unencrypted passport numbers stolen, as well as 8 million credit card numbers.
If customer trust in the Marriott brand wasn't already as low as it could get, I'd say it's close to hitting rock bottom soon. This is the sort of stuff that keeps CISOs awake at night, as they feel like sitting ducks in the war against cyber threats. Just look at Equifax, Yahoo, Sony, Target - these are just a few huge names that have endured large-scale breaches, representing billions of stolen data records, hundred of billions of dollars in damage, and customer-shaped holes punched right through their economic hearts. It's a disaster for the business (Target reported a $440 million profit plunge in the quarter following their 2014 breach), and while individual people aren't typically held responsible -- after all, software security should be a shared responsibility -- it's something you don't exactly want on an otherwise glowing resume if you happened to work for these organizations at the time.
Foregoing a robust security program to achieve compliance in an organization dealing with payments, sensitive data and the intangible gold that is positive customer sentiment, is an indicator of a company that is not only at-risk, but seriously lagging behind in innovation.
Everyone should care about trust issues in the customer/organization relationship.
Apart from the stress and calamity the IT, development, and security departments face after a breach, the trust factor is a major element in the long-term success of a newer company, or the continued growth of an established one. The obvious thing you stand to lose is your job, should the company be faced with an economic downturn as a result of lost faith.
The PCI-DSS regulations hold businesses accountable -- and as above, ignoring these well-laid plans has enormous implications -- but they're only as good as the security program that is put in place, and the people working within it. If you take them seriously, stay aware, and set an example for others, then you are setting yourself apart in a very positive way.
Awareness is everything.
A failing security awareness program is going to make most attempts to stay PCI-compliant close to useless. Organization-wide security awareness forms the most critical part of the best practice guidelines; they even offer their own training modules on how this can be implemented in cross-functional roles, and what this looks like in businesses who are doing it right.
As we move towards DevSecOps as the current gold standard in secure software development -- in which security as a shared responsibility is fundamental -- businesses must spend the time, money and effort to ensure everyone, including vendors and contractors, is security-aware and following best practices.
A security-aware developer is a compliant developer (and getting there doesn't have to be boring)
When it comes to becoming a "certified" compliant PCI-DSS developer, there aren't a whole lot of obvious options. Why? Probably because it cannot be a "one and done" exercise.
The OWASP organization is one of the best on the planet when it comes to learning how to thwart common vulnerabilities, and their Top 10 is formally listed in the PCI-DSS guidelines for developers. However, keeping security front-of-mind and honing skills takes time and continued effort. And nobody wants this to be uninspiring and a waste of effort.
A positive security culture is not a "nice to have" in an organization; if they're taking security seriously, then it needs to be part of the everyday running of the company.
Developers are on the front lines of battle when it comes to stopping vulnerabilities. Are they receiving the support, tools, and training to hold up their part of the security deal in PCI-DSS compliance?
The truth is, the right training is more seamless; it shouldn't feel like a lecture, and it should be highly relevant to the work being done every day. And this kind of hands-on training is an upskilling opportunity - a career move that only has positives for developers who are serious about stopping vulnerabilities and working with the rest of the team to produce a higher standard of code.
Want to test your secure coding skills right now? Choose your mission.
Table of contents
Matias Madou, Ph.D. is a security expert, researcher, and CTO and co-founder of Secure Code Warrior. Matias obtained his Ph.D. in Application Security from Ghent University, focusing on static analysis solutions. He later joined Fortify in the US, where he realized that it was insufficient to solely detect code problems without aiding developers in writing secure code. This inspired him to develop products that assist developers, alleviate the burden of security, and exceed customers' expectations. When he is not at his desk as part of Team Awesome, he enjoys being on stage presenting at conferences including RSA Conference, BlackHat and DefCon.
Secure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.
Book a demoDownloadResources to get you started
Resources to get you started
10 Key Predictions: Secure Code Warrior on AI & Secure-by-Design’s Influence in 2025
Organizations are facing tough decisions on AI usage to support long-term productivity, sustainability, and security ROI. It’s become clear to us over the last few years that AI will never fully replace the role of the developer. From AI + developer partnerships to the increasing pressures (and confusion) around Secure-by-Design expectations, let’s take a closer look at what we can expect over the next year.
OWASP Top 10 For LLM Applications: What’s New, Changed, and How to Stay Secure
Stay ahead in securing LLM applications with the latest OWASP Top 10 updates. Discover what's new, what’s changed, and how Secure Code Warrior equips you with up-to-date learning resources to mitigate risks in Generative AI.
Trust Score Reveals the Value of Secure-by-Design Upskilling Initiatives
Our research has shown that secure code training works. Trust Score, using an algorithm drawing on more than 20 million learning data points from work by more than 250,000 learners at over 600 organizations, reveals its effectiveness in driving down vulnerabilities and how to make the initiative even more effective.
.png)
Reactive Versus Preventive Security: Prevention Is a Better Cure
The idea of bringing preventive security to legacy code and systems at the same time as newer applications can seem daunting, but a Secure-by-Design approach, enforced by upskilling developers, can apply security best practices to those systems. It’s the best chance many organizations have of improving their security postures.
Developer-driven coding.
Securely.
Contact us today and make software security an intrinsic part of your development process.
