Strike first, strike hard: Why curated secure coding courses extend no mercy to cyber threats

There is something of an inconvenient truth out there, one that tends to be glossed over by governments, big corporations, and even some industry leaders: as a society, we are in a constant battle against cyber threats, and we are currently on the losing side. How do we know this? These statistics tell a sobering story:

• Cybercrime is estimated to have a global cost of USD $6 trillion by 2021
• A cyberattack occurs every 39 seconds
• 24% of data breaches are caused by human error
• An alarming 77% of organizations do not have a cybersecurity incident response plan that scales across the enterprise, and is applied consistently between departments.

When it comes to cybersecurity specialists, we are critically understaffed; the skills gap is unlikely to be filled, and there is no secret AppSec army coming to bail us out. We've known this for years, and we've got to change our approach. In our case, the best attack is a great defense, and we can strike first with a good plan.

This all sounds a bit depressing, but it's not as bad as some may have us believe. We've got an ace up our sleeve, and the cybersecurity climate presents us with a golden opportunity. You need not look further than your internal development teams for the personnel that will come to rescue the organization, but your security program must support their trajectory to becoming security-aware engineers that are ready to share the responsibility of coding securely.

Any old training won't do the job - we've certainly said that enough - but even the right training that engages, builds contextual knowledge and helps developers love security could be far more effective, if only it was more curated for the needs of the business, the threats they face, and the compliance requirements that help businesses keep all of our data safe.

And that's where our newest features, Courses, comes into play. By the way, if you got the reference in the title, you're officially old (or just appreciate a classic).

Organization-specific learning: build defense, bolster developer skills

We have all kinds of opinions on why some types of developer training are better than others (i.e. don't bore them to death with hours of dry, generic video sermons, and then expect a passion for secure coding to bloom). But even with competitive learning that is designed to appeal to a developer mindset, the content may still be a little broader than is needed for particular requirements within an organization.

A curated course containing the exact modules in which your developers would need to show proficiency will have a potent impact, and allow them to hit the ground running when it comes to security best practices in their day-to-day work. Tailor programs to suit frontend teams, cloud engineers, and more, with the ability to drill down into the vulnerabilities that matter most, in the languages and frameworks that are relevant to them. Developers will grow their skills with continual context, touchpoints and experience, while the business will benefit from precision awareness on the issues that pose the most risk.

Customize a course for compliance

Tighter cybersecurity-related regulations are being imposed all over the world, and software security compliance is a great foundation on which to build a positive, effective security culture. It shouldn't be boring, and a good security program ignites a sense of pride and responsibility in developers, as opposed to a groan and facepalm.

As a starting point, it is a very good idea to get everyone up to speed with the OWASP Top 10, but to really reach new heights in industry-relevant compliance, you can design a custom course around the requirements of specific regulations. For example, a financial organization could tailor a course to suit the compliance requirements of their software, in accordance with the PCI-DSS guidelines that govern payment and card processing applications. The stakes are high when you're in charge of processing and storing sensitive information like credit card numbers, and getting ultra-specific with developer learning cuts through the noise, delivers the right education at the right time, and makes team aptitude far easier to monitor.  

This is how General Electric (GE) is using Courses within their teams:

"Courses are a great solution for our engineers. With the new feature - which bundles the learning pathway, videos and checkpoints into a customizable module - we have the ability to shape content based on what we need at any given moment. The compliance capabilities and flexibility provide an even better opportunity to ensure a more streamlined and flexible process.  This capability has helped General Electric to tailor relevant training to each engineer faster and easier than ever."

And remember, it might be curated compliance training, but it's still delivered as the bite-sized, contextual, engaging learning experience that is far more appealing to developers.

A positive security culture built on respect and relevance

Education is a lifelong process, but in the frantic world of DevSecOps, there are a lot of plates to spin. The time set aside for training should be used wisely, with a viable learning path that continues to engage and add value.

By curating a custom course that is hyper-relevant, you are respecting the developer's time and workflow, while at the same time working towards a measurable reduction of vulnerabilities and cybersecurity risks for the business.

The relationship between AppSec specialists and engineers is traditionally fraught with misunderstandings and strain, but structured learning with Courses can enable both parties to get on the same page with security best practices. Developers will certainly appreciate some solutions-focused enablement from the AppSec team, which minimizes the load on them and assists them in crafting a higher standard of code.

Erase weaknesses, scale enterprise-level security hygiene

We're all human, and unfortunately, we make mistakes. Those mistakes can be extremely costly in the digital world, yet they are astoundingly common. Symantec's 2019 Internet Security Threat Report confirmed that more than 70 million records were stolen as a result of misconfigured S3 buckets. Security misconfigurations are a leading cause of data breaches, with human error accounting for around a quarter of them.

These issues happen for a number of reasons, but a lack of security awareness and training is a huge driver for small windows of opportunity being left open for attackers to exploit. For scalable security hygiene that makes an impact, you must make it count with a course custom-made for your business. Show no mercy to your foes, and shut down every opportunity for them to cause the biggest headache you're ever likely to encounter.

We're already seeing an amazing impact with our clients, including this leading cloud-based accounting SaaS provider:

"Courses'tailored learning pathway has been a game-changer. The specificity around the programming languages and the vulnerabilities provide more control and flexibility to create the right learning experience for each developer based on individual and company needs. Using Courses in conjunction with Secure Code Warrior's wider secure coding platform has transformed our developers'engagement, in that they are now more interested in enhancing their secure coding skills to write better and more secure code."

Get DevSec-ready. Find out more about Secure Code Warriors all-new Courses feature here.