Realigning your organization around secure coding – barriers, concerns, and active solutions
In our hyper-connected world, almost every organization shares a common Achilles heel. A single vulnerability, just one exploitable chink in their code, can trigger the theft of customer data, reputational damage and significant financial losses. Organizational alignment around secure coding has never been more imperative – but achieving it is easier said than done. So in 2020, Secure Code Warrior engaged with Evans Data Corp. to conduct primary research* into developers' and managers’ attitudes towards secure coding, secure code practices, and security operations.
In this environment where cybersecurity is paramount, the traditional KPIs for project success are being redefined – but not quickly enough.
When we asked developers and managers about the most critical priorities in the software development process:
- 76% nominated application performance
- 62% picked features and functionality
- And a little over 50% selected secure code
Today, as we can see, security is not a critical priority.
But looking to the future, the picture changes dramatically. When asked about the most vital future priorities for measuring project success,79% of developers agree that secure coding will become more critical. In fact, developers see security as the KPI whose importance will increase the most.
But even though awareness of secure coding is increasing, there are concerns around its adoption. For developers and managers alike, dealing with vulnerabilities and being accountable for code is enough to keep them up at night. Our research* showed that both these groups share the same basic set of concerns, which point to a need for better training in secure coding practices.
Concerns and barriers around secure coding practices
The number one concern for developers is ‘including code that replicates previous vulnerabilities’. As developers are judged on the quality of their code, this is hardly surprising. No developer wants to be the source of insecure code – or code that requires rework and slows down their team.
The second most significant concern for developers is dealing with mistakes introduced by coworkers. Meeting deadlines and being accountable for code are also high on the list – as is the fact that learning about secure code is challenging, which echoes developers dissatisfaction with current training approaches.
Managers, on the other hand, take more of a top-down view. Their number one concern is being accountable for bad code or code that replicates previous vulnerabilities. After all, if their team produces lousy code, the buck stops with the manager.
The fact that the learning process is challenging comes in third – this is not the only barrier to secure coding practices.
45% identified a lack of communication between stakeholders and management as a significant roadblock. 42% lament the lack of secure coding skills among new hires. At the same time, 40% nominated inadequate training time and resources.
Current secure code training approaches are not delivering – and managers realize a new approach is needed.
Who’s responsible for secure code practices?
By its very nature, the practice of secure coding means considering security much earlier in the SDLC. It means actively building security in as software as it’s written, from the start, instead of leaving this to later. In other words, to ‘shifting left’. This ‘shift left’ is the essence of secure coding practice. And it means that, ultimately, everyone in an organization should be responsible for secure code. But right now, only 15% of developers agree.
However, while most developers still see security as someone else's problem, a small but growing cohort not only actively embraces secure coding but champions it within their organization. 29% of developers surveyed agree that such go-to people exist in their workplace. The problem is these secure code champions are still too thin on the ground.
Creating more security champions
Development managers are aware of the need to identify and create new security champions and raise the secure coding skills of developers in general.
Many managers also put a premium on secure coding skills when hiring new developers and value secure coding experience among developers who are already parts of their teams.
83% of managers surveyed say they ask developers to learn or adopt secure coding practices. Roughly three-quarters of surveyed managers say that they provide incentives for developers to engage with secure code training. These incentives range from formal recognition to greater responsibilities to higher pay.
It's clear that development managers are critical influencers of the adoption of secure coding practices at the organizational level – and instrumental to spotting security champions.
But when it comes to creating more of these champions, what motivates developers to learn about secure coding? Our research shows that they see it as means to increase their productivity and efficiency.
So why don’t developers push for more secure code training? What stands in the way of aligning themselves with a growing organizational need?
Solutions to begin to address realignment
Developers don't want to sit around listening to lecturers – they want to get their hands on stuff and try it for themselves. They want a focus on practical applications – something current training programs sorely lack. When asked to identify how company-provided training could improve, 30% of respondents revealed that they would like that training focused on practical applications, particularly authentic work scenarios.
Current training practices fail to deliver this. A new approach is called for – and as champions of change, Secure Code Warrior takes a human-led approach to help organizations realign around secure coding. Our cybersecurity Courses offer guided learning pathways that include hands-on, 'gamified' coding challenges that mimic those developers face in the real world.
This training is language:framework-specific, unlike generic training, which often goes in one ear and out the other.
When it comes to realigning culture, Tournaments can be used to measure coders’ security skills, establish a baseline for future skills development, and spot the potential security champions within your development team.
If you’d like to know more about secure code training that aligns the needs of managers, developers and the organization towards a secure coding future, book a demo now.
*Shifting from reaction to prevention: The changing face of application security. Secure Code Warrior and Evans Data Corp. 2020
.avif)
In our hyper-connected world, almost every organization shares a common Achilles heel. A single vulnerability, just one exploitable chink in their code, can trigger the theft of customer data, reputational damage and significant financial losses. Organizational alignment around secure coding has never been more imperative – but achieving it is easier said than done.
Secure Code Warrior makes secure coding a positive and engaging experience for developers as they increase their skills. We guide each coder along their own preferred learning pathway, so that security-skilled developers become the everyday superheroes of our connected world.
Secure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.
Book a demo
Secure Code Warrior makes secure coding a positive and engaging experience for developers as they increase their skills. We guide each coder along their own preferred learning pathway, so that security-skilled developers become the everyday superheroes of our connected world.
Secure Code Warrior builds a culture of security-driven developers by giving them the skills to code securely. Our flagship Agile Learning Platform delivers relevant skills-based pathways, hands-on missions, and contextual tools for developers to rapidly learn, build, and apply their skills to write secure code at speed.
In our hyper-connected world, almost every organization shares a common Achilles heel. A single vulnerability, just one exploitable chink in their code, can trigger the theft of customer data, reputational damage and significant financial losses. Organizational alignment around secure coding has never been more imperative – but achieving it is easier said than done. So in 2020, Secure Code Warrior engaged with Evans Data Corp. to conduct primary research* into developers' and managers’ attitudes towards secure coding, secure code practices, and security operations.
In this environment where cybersecurity is paramount, the traditional KPIs for project success are being redefined – but not quickly enough.
When we asked developers and managers about the most critical priorities in the software development process:
- 76% nominated application performance
- 62% picked features and functionality
- And a little over 50% selected secure code
Today, as we can see, security is not a critical priority.
But looking to the future, the picture changes dramatically. When asked about the most vital future priorities for measuring project success,79% of developers agree that secure coding will become more critical. In fact, developers see security as the KPI whose importance will increase the most.
But even though awareness of secure coding is increasing, there are concerns around its adoption. For developers and managers alike, dealing with vulnerabilities and being accountable for code is enough to keep them up at night. Our research* showed that both these groups share the same basic set of concerns, which point to a need for better training in secure coding practices.
Concerns and barriers around secure coding practices
The number one concern for developers is ‘including code that replicates previous vulnerabilities’. As developers are judged on the quality of their code, this is hardly surprising. No developer wants to be the source of insecure code – or code that requires rework and slows down their team.
The second most significant concern for developers is dealing with mistakes introduced by coworkers. Meeting deadlines and being accountable for code are also high on the list – as is the fact that learning about secure code is challenging, which echoes developers dissatisfaction with current training approaches.
Managers, on the other hand, take more of a top-down view. Their number one concern is being accountable for bad code or code that replicates previous vulnerabilities. After all, if their team produces lousy code, the buck stops with the manager.
The fact that the learning process is challenging comes in third – this is not the only barrier to secure coding practices.
45% identified a lack of communication between stakeholders and management as a significant roadblock. 42% lament the lack of secure coding skills among new hires. At the same time, 40% nominated inadequate training time and resources.
Current secure code training approaches are not delivering – and managers realize a new approach is needed.
Who’s responsible for secure code practices?
By its very nature, the practice of secure coding means considering security much earlier in the SDLC. It means actively building security in as software as it’s written, from the start, instead of leaving this to later. In other words, to ‘shifting left’. This ‘shift left’ is the essence of secure coding practice. And it means that, ultimately, everyone in an organization should be responsible for secure code. But right now, only 15% of developers agree.
However, while most developers still see security as someone else's problem, a small but growing cohort not only actively embraces secure coding but champions it within their organization. 29% of developers surveyed agree that such go-to people exist in their workplace. The problem is these secure code champions are still too thin on the ground.
Creating more security champions
Development managers are aware of the need to identify and create new security champions and raise the secure coding skills of developers in general.
Many managers also put a premium on secure coding skills when hiring new developers and value secure coding experience among developers who are already parts of their teams.
83% of managers surveyed say they ask developers to learn or adopt secure coding practices. Roughly three-quarters of surveyed managers say that they provide incentives for developers to engage with secure code training. These incentives range from formal recognition to greater responsibilities to higher pay.
It's clear that development managers are critical influencers of the adoption of secure coding practices at the organizational level – and instrumental to spotting security champions.
But when it comes to creating more of these champions, what motivates developers to learn about secure coding? Our research shows that they see it as means to increase their productivity and efficiency.
So why don’t developers push for more secure code training? What stands in the way of aligning themselves with a growing organizational need?
Solutions to begin to address realignment
Developers don't want to sit around listening to lecturers – they want to get their hands on stuff and try it for themselves. They want a focus on practical applications – something current training programs sorely lack. When asked to identify how company-provided training could improve, 30% of respondents revealed that they would like that training focused on practical applications, particularly authentic work scenarios.
Current training practices fail to deliver this. A new approach is called for – and as champions of change, Secure Code Warrior takes a human-led approach to help organizations realign around secure coding. Our cybersecurity Courses offer guided learning pathways that include hands-on, 'gamified' coding challenges that mimic those developers face in the real world.
This training is language:framework-specific, unlike generic training, which often goes in one ear and out the other.
When it comes to realigning culture, Tournaments can be used to measure coders’ security skills, establish a baseline for future skills development, and spot the potential security champions within your development team.
If you’d like to know more about secure code training that aligns the needs of managers, developers and the organization towards a secure coding future, book a demo now.
*Shifting from reaction to prevention: The changing face of application security. Secure Code Warrior and Evans Data Corp. 2020
In our hyper-connected world, almost every organization shares a common Achilles heel. A single vulnerability, just one exploitable chink in their code, can trigger the theft of customer data, reputational damage and significant financial losses. Organizational alignment around secure coding has never been more imperative – but achieving it is easier said than done. So in 2020, Secure Code Warrior engaged with Evans Data Corp. to conduct primary research* into developers' and managers’ attitudes towards secure coding, secure code practices, and security operations.
In this environment where cybersecurity is paramount, the traditional KPIs for project success are being redefined – but not quickly enough.
When we asked developers and managers about the most critical priorities in the software development process:
- 76% nominated application performance
- 62% picked features and functionality
- And a little over 50% selected secure code
Today, as we can see, security is not a critical priority.
But looking to the future, the picture changes dramatically. When asked about the most vital future priorities for measuring project success,79% of developers agree that secure coding will become more critical. In fact, developers see security as the KPI whose importance will increase the most.
But even though awareness of secure coding is increasing, there are concerns around its adoption. For developers and managers alike, dealing with vulnerabilities and being accountable for code is enough to keep them up at night. Our research* showed that both these groups share the same basic set of concerns, which point to a need for better training in secure coding practices.
Concerns and barriers around secure coding practices
The number one concern for developers is ‘including code that replicates previous vulnerabilities’. As developers are judged on the quality of their code, this is hardly surprising. No developer wants to be the source of insecure code – or code that requires rework and slows down their team.
The second most significant concern for developers is dealing with mistakes introduced by coworkers. Meeting deadlines and being accountable for code are also high on the list – as is the fact that learning about secure code is challenging, which echoes developers dissatisfaction with current training approaches.
Managers, on the other hand, take more of a top-down view. Their number one concern is being accountable for bad code or code that replicates previous vulnerabilities. After all, if their team produces lousy code, the buck stops with the manager.
The fact that the learning process is challenging comes in third – this is not the only barrier to secure coding practices.
45% identified a lack of communication between stakeholders and management as a significant roadblock. 42% lament the lack of secure coding skills among new hires. At the same time, 40% nominated inadequate training time and resources.
Current secure code training approaches are not delivering – and managers realize a new approach is needed.
Who’s responsible for secure code practices?
By its very nature, the practice of secure coding means considering security much earlier in the SDLC. It means actively building security in as software as it’s written, from the start, instead of leaving this to later. In other words, to ‘shifting left’. This ‘shift left’ is the essence of secure coding practice. And it means that, ultimately, everyone in an organization should be responsible for secure code. But right now, only 15% of developers agree.
However, while most developers still see security as someone else's problem, a small but growing cohort not only actively embraces secure coding but champions it within their organization. 29% of developers surveyed agree that such go-to people exist in their workplace. The problem is these secure code champions are still too thin on the ground.
Creating more security champions
Development managers are aware of the need to identify and create new security champions and raise the secure coding skills of developers in general.
Many managers also put a premium on secure coding skills when hiring new developers and value secure coding experience among developers who are already parts of their teams.
83% of managers surveyed say they ask developers to learn or adopt secure coding practices. Roughly three-quarters of surveyed managers say that they provide incentives for developers to engage with secure code training. These incentives range from formal recognition to greater responsibilities to higher pay.
It's clear that development managers are critical influencers of the adoption of secure coding practices at the organizational level – and instrumental to spotting security champions.
But when it comes to creating more of these champions, what motivates developers to learn about secure coding? Our research shows that they see it as means to increase their productivity and efficiency.
So why don’t developers push for more secure code training? What stands in the way of aligning themselves with a growing organizational need?
Solutions to begin to address realignment
Developers don't want to sit around listening to lecturers – they want to get their hands on stuff and try it for themselves. They want a focus on practical applications – something current training programs sorely lack. When asked to identify how company-provided training could improve, 30% of respondents revealed that they would like that training focused on practical applications, particularly authentic work scenarios.
Current training practices fail to deliver this. A new approach is called for – and as champions of change, Secure Code Warrior takes a human-led approach to help organizations realign around secure coding. Our cybersecurity Courses offer guided learning pathways that include hands-on, 'gamified' coding challenges that mimic those developers face in the real world.
This training is language:framework-specific, unlike generic training, which often goes in one ear and out the other.
When it comes to realigning culture, Tournaments can be used to measure coders’ security skills, establish a baseline for future skills development, and spot the potential security champions within your development team.
If you’d like to know more about secure code training that aligns the needs of managers, developers and the organization towards a secure coding future, book a demo now.
*Shifting from reaction to prevention: The changing face of application security. Secure Code Warrior and Evans Data Corp. 2020
Click on the link below and download the PDF of this resource.
Secure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.
View reportBook a demo
Secure Code Warrior makes secure coding a positive and engaging experience for developers as they increase their skills. We guide each coder along their own preferred learning pathway, so that security-skilled developers become the everyday superheroes of our connected world.
Secure Code Warrior builds a culture of security-driven developers by giving them the skills to code securely. Our flagship Agile Learning Platform delivers relevant skills-based pathways, hands-on missions, and contextual tools for developers to rapidly learn, build, and apply their skills to write secure code at speed.
In our hyper-connected world, almost every organization shares a common Achilles heel. A single vulnerability, just one exploitable chink in their code, can trigger the theft of customer data, reputational damage and significant financial losses. Organizational alignment around secure coding has never been more imperative – but achieving it is easier said than done. So in 2020, Secure Code Warrior engaged with Evans Data Corp. to conduct primary research* into developers' and managers’ attitudes towards secure coding, secure code practices, and security operations.
In this environment where cybersecurity is paramount, the traditional KPIs for project success are being redefined – but not quickly enough.
When we asked developers and managers about the most critical priorities in the software development process:
- 76% nominated application performance
- 62% picked features and functionality
- And a little over 50% selected secure code
Today, as we can see, security is not a critical priority.
But looking to the future, the picture changes dramatically. When asked about the most vital future priorities for measuring project success,79% of developers agree that secure coding will become more critical. In fact, developers see security as the KPI whose importance will increase the most.
But even though awareness of secure coding is increasing, there are concerns around its adoption. For developers and managers alike, dealing with vulnerabilities and being accountable for code is enough to keep them up at night. Our research* showed that both these groups share the same basic set of concerns, which point to a need for better training in secure coding practices.
Concerns and barriers around secure coding practices
The number one concern for developers is ‘including code that replicates previous vulnerabilities’. As developers are judged on the quality of their code, this is hardly surprising. No developer wants to be the source of insecure code – or code that requires rework and slows down their team.
The second most significant concern for developers is dealing with mistakes introduced by coworkers. Meeting deadlines and being accountable for code are also high on the list – as is the fact that learning about secure code is challenging, which echoes developers dissatisfaction with current training approaches.
Managers, on the other hand, take more of a top-down view. Their number one concern is being accountable for bad code or code that replicates previous vulnerabilities. After all, if their team produces lousy code, the buck stops with the manager.
The fact that the learning process is challenging comes in third – this is not the only barrier to secure coding practices.
45% identified a lack of communication between stakeholders and management as a significant roadblock. 42% lament the lack of secure coding skills among new hires. At the same time, 40% nominated inadequate training time and resources.
Current secure code training approaches are not delivering – and managers realize a new approach is needed.
Who’s responsible for secure code practices?
By its very nature, the practice of secure coding means considering security much earlier in the SDLC. It means actively building security in as software as it’s written, from the start, instead of leaving this to later. In other words, to ‘shifting left’. This ‘shift left’ is the essence of secure coding practice. And it means that, ultimately, everyone in an organization should be responsible for secure code. But right now, only 15% of developers agree.
However, while most developers still see security as someone else's problem, a small but growing cohort not only actively embraces secure coding but champions it within their organization. 29% of developers surveyed agree that such go-to people exist in their workplace. The problem is these secure code champions are still too thin on the ground.
Creating more security champions
Development managers are aware of the need to identify and create new security champions and raise the secure coding skills of developers in general.
Many managers also put a premium on secure coding skills when hiring new developers and value secure coding experience among developers who are already parts of their teams.
83% of managers surveyed say they ask developers to learn or adopt secure coding practices. Roughly three-quarters of surveyed managers say that they provide incentives for developers to engage with secure code training. These incentives range from formal recognition to greater responsibilities to higher pay.
It's clear that development managers are critical influencers of the adoption of secure coding practices at the organizational level – and instrumental to spotting security champions.
But when it comes to creating more of these champions, what motivates developers to learn about secure coding? Our research shows that they see it as means to increase their productivity and efficiency.
So why don’t developers push for more secure code training? What stands in the way of aligning themselves with a growing organizational need?
Solutions to begin to address realignment
Developers don't want to sit around listening to lecturers – they want to get their hands on stuff and try it for themselves. They want a focus on practical applications – something current training programs sorely lack. When asked to identify how company-provided training could improve, 30% of respondents revealed that they would like that training focused on practical applications, particularly authentic work scenarios.
Current training practices fail to deliver this. A new approach is called for – and as champions of change, Secure Code Warrior takes a human-led approach to help organizations realign around secure coding. Our cybersecurity Courses offer guided learning pathways that include hands-on, 'gamified' coding challenges that mimic those developers face in the real world.
This training is language:framework-specific, unlike generic training, which often goes in one ear and out the other.
When it comes to realigning culture, Tournaments can be used to measure coders’ security skills, establish a baseline for future skills development, and spot the potential security champions within your development team.
If you’d like to know more about secure code training that aligns the needs of managers, developers and the organization towards a secure coding future, book a demo now.
*Shifting from reaction to prevention: The changing face of application security. Secure Code Warrior and Evans Data Corp. 2020
Table of contents
Secure Code Warrior makes secure coding a positive and engaging experience for developers as they increase their skills. We guide each coder along their own preferred learning pathway, so that security-skilled developers become the everyday superheroes of our connected world.
Secure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.
Book a demoDownloadResources to get you started
Benchmarking Security Skills: Streamlining Secure-by-Design in the Enterprise
The Secure-by-Design movement is the future of secure software development. Learn about the key elements companies need to keep in mind when they think about a Secure-by-Design initiative.
DigitalOcean Decreases Security Debt with Secure Code Warrior
DigitalOcean's use of Secure Code Warrior training has significantly reduced security debt, allowing teams to focus more on innovation and productivity. The improved security has strengthened their product quality and competitive edge. Looking ahead, the SCW Trust Score will help them further enhance security practices and continue driving innovation.
Resources to get you started
Trust Score Reveals the Value of Secure-by-Design Upskilling Initiatives
Our research has shown that secure code training works. Trust Score, using an algorithm drawing on more than 20 million learning data points from work by more than 250,000 learners at over 600 organizations, reveals its effectiveness in driving down vulnerabilities and how to make the initiative even more effective.
.png)
Reactive Versus Preventive Security: Prevention Is a Better Cure
The idea of bringing preventive security to legacy code and systems at the same time as newer applications can seem daunting, but a Secure-by-Design approach, enforced by upskilling developers, can apply security best practices to those systems. It’s the best chance many organizations have of improving their security postures.
The Benefits of Benchmarking Security Skills for Developers
The growing focus on secure code and Secure-by-Design principles requires developers to be trained in cybersecurity from the start of the SDLC, with tools like Secure Code Warrior’s Trust Score helping measure and improve their progress.
Driving Meaningful Success for Enterprise Secure-by-Design Initiatives
Our latest research paper, Benchmarking Security Skills: Streamlining Secure-by-Design in the Enterprise is the result of deep analysis of real Secure-by-Design initiatives at the enterprise level, and deriving best practice approaches based on data-driven findings.
Developer-driven coding.
Securely.
Contact us today and make software security an intrinsic part of your development process.
