How’s this for a sobering statistic? 60% of SMBs go out of business within six months of a successful cyber attack*. Major corporations haemorrhage millions (or billions!) while brand reputations bleed out. As organizations increasingly embrace secure coding practices, a 'shift left' is taking place. With the rise of DevSecOps, secure code is becoming the focus right from the start of the SDLC. To investigate the real-world impacts of this trend, Secure Code Warrior with Evans Data Corp*** commissioned a recent study on developers’ attitudes towards secure coding, secure code practices, and security operations. 

Shifting Left – a shift on many levels  

As companies realize it costs 30 times more to fix vulnerabilities after the fact, preemptive measures have become the new gold standard*. But for such measures to be effective, everyone in the SDLC must be security-aware, especially developers. 

‍Shift One  – so, who’s responsible now? 

With the rise of DevSecOps, organizations are embracing secure coding practices. As a result, one of the first shifts our research highlighted is a shift in responsibility for code security towards operational levels. 

When we asked developers and development managers, "who should have ultimate responsibility for code security?", 46% said the project/team lead –  almost twice as many as those  who said the responsibility should remain with the application security team. 

This is a clear indication of a shift in security responsibility away from traditional application security teams towards development team leads.

Shift Two – The Changing Roles of Managers  

The pressure to implement secure code training is landing on managers from several directions. 

41% reveal that the organizational imperative for secure code training comes from senior leadership. Increasing demands for regulatory compliance are also a factor. 

Managers play critical roles in assisting with the transition from traditional development to DevSecOps and are emerging as crucial decision-makers for training and tooling purchase decisions.

‍Shift Three – Developers Stepping Up

However, we also see the pressure for change bubbling up from below; 24% of managers reveal that they implement secure coding practices due to suggestions and recommendations from their developers. This point highlights the increasingly important role of developers as contributors to their companies’ security programs. The shift to DevSecOps, with its newfound emphasis on preventative secure coding practices, shifts developers into the role of the 'first line of defense’.

Shift Four – Improved Team Dynamics  

While implementing secure code practices has a material impact on software quality, it also changes the way teams work for the better. 60% of developers surveyed believe that employing secure code practices has increased their communication with other developers – but the gains don’t stop there. 

Half of all developers and managers surveyed agreed that secure coding practices led to more cooperation between developers and their leaders. 46% claimed more collaboration between developers and stakeholders. At the same time, 41% pointed to more cooperation between leaders and stakeholders.

DevSecOps brings teams, leaders, and stakeholders together in new ways, improving cooperation across different roles and stages of the software development life cycle. 

62% of managers surveyed claim that secure code practices help increase the velocity of code releases. This single fact combines with all these other shifts to highlight the clear benefits of moving to a DevOps approach. But, as stated earlier in this article, for such measures to be effective, everyone in the SDLC must be security-aware. This insight has critical implications for how organizations train their developers. Teams need to learn about recently identified vulnerabilities and learn in the specific language:frameworks in which they code. In short, they need to understand how to locate, identify and fix known vulnerabilities in code in the context they work in every day. Such training turns your teams from your first line of risk into your first line of defense.  

As champions of change in secure coding, Secure Code Warrior takes a human-led approach to help your organization' shift left' – and take your overall security approach from reactive to proactive.

If you’d like to know more about hands-on, highly engaging and proven secure code training that aligns the needs of managers, developers and the organization to achieve a DevSecOps future, book a demo now.

‍

*60 Percent Of Small Companies Close Within 6 Months Of Being Hacked.
‍https://cybersecurityventures.com/60-percent-of-small-companies-close-within-6-months-of-being-hacked/

**IBM Software Group; Minimizing Code Defects to Improve Software Quality and Lower Development Costs.
‍https://docplayer.net/11413245-Minimizing-code-defects-to-improve-software-quality-and-lower-development-costs.html

***Shifting from reaction to prevention: The changing face of application security 2021. Secure Code Warrior and Evans Data Corp.
https://scw.buzz/3169uzS

Manage dependencies flexibly

The Scope functionality of Sensei has always been a favorite of developers. With the ability to expand or limit the scope of a recipe’s application, development teams have been able to customize its usage to individual projects and verticals within their organizations - empowering developers to personalize their experience.

And understandably, it is at the center of Sensei’s continuous innovation processes. During an innovation brainstorming session on expanding the scope of “scope” (yes, pun intended), a question came up: 

"I was trying to create a recipe for ... but since version x, the framework has deprecated the feature. I am not sure whether it will be useful to create a recipe anymore. What do you think?"

Of course, this is not the first time we have hesitated to create a recipe. While the recipe might be seen as providing redundant information, we believe it is valuable to create something that is applicable to a limited number of versions of the involved dependency. And therefore, we created the Library scope.

Library scope enables us to check whether a dependency is present in the project and conditionally apply Sensei recipes. This gives great flexibility as teams navigate through legacy code and dependencies.

Many of you might know of the Library scope that is already available under General Settings. So what is this you ask? We have enabled Library Scope to be present in YAML, just like the search. This creates a better user experience and does not break your flow as you create the recipe, which otherwise would have you navigate to General Settings and back to update metadata. More of these scopes will come into YAML but we have started with the Library Scope.

So let us dive a little further into how it works with an example.

Library scope applied to hibernate-jpamodelgen

Imagine the following case: 

We want to create a Spring Web REST API that allows us to query some data. According to the best practices, we create a model for the entity we want to query. Next, we add a dependency to Hibernate ORM, so that we do not need to fiddle with the database structure. The ORM takes care of that for us. We also need to create a service that provides the data from the data access layer (CRUD repositories and so on) to the controller. Finally, we create the controller class for our API, where we will expose the allowed queries as endpoints.

To prevent having to expose different endpoints for each field that can be queried, we instead opt to use JPA 2 Specifications. To do so, we create a specification in the controller from the request URL. This specification describes what the entities we are looking for should look like. In the `Specification` class itself, we implement the `toPredicate` method to indicate how the specification can be validated.

But we are faced with an issue in the `toPredicate` method. To construct the predicate, we need to know the names of the columns in the database to compare. But because we are using an ORM, we do not have these columns present in a separate model. So, Hibernate's JPA 2 Metamodel Generator() comes to the rescue! This will help generate a metamodel for the entities we requested it to handle. These metamodels allow us to reference the column names as properties instead of hardcoding them.

Creating the Sensei recipe

Now that we have the metamodels generated, we want to put them to good use. Sensei can help anyone who works on the project by reminding them to use the metamodel, making sure that column names are not hardcoded anywhere. So let’s put that into practice.

To start, we take a look at the `toPredicate` method:‍

This basic predicate will only compare the name of our entity. We can expand on it using `and` clauses, but for the purpose of this recipe, this 'simple' check will do.

For the search component of the recipe, we want to call the method `get()` of the root parameter, so we select the `methodcall` option from the dropdown. Next, we want to limit the search to a methodcall with the name `get` whose signature is declared in the `Path` interface of the `javax.persistence.criteria` package. As the method has been overloaded, we also need to tell the search that our recipe only applies to the variant that takes a single string as an argument. To fix the issue of having the column names in the code we would want to use an argument of type `SingularAttribute` instead, the same type provided by the metamodel generator.

The recipe that we have created so far will trigger on any codebase that uses the JPA 2 `Path` interface, regardless of whether the codebase is set up to use the Hibernate Model Generator. If this library is present in the project, we want to indicate to the user that it should be used, so we add a library scope to the recipe.

And finally, our recipe is now ready.

With this recipe, any occurrence of `Path#get` that uses a string value as an argument will be flagged. As you can tell from the highlighted example code in the above screenshot, this recipe still works when the literal name of the column name is stored in an intermediate variable.

Note - We can also invert the library scope to handle the case where the library is not available, by prepending a `not` clause to the scope.

Conclusion

As we have seen in the example above, this new feature enables us to create more useful recipes by applying them based on the presence of dependencies in the project. To enhance its power even further, we included more options than were shown in the example, such as not only checking whether the dependency is present, but also applying conditions to the specific version of the dependency. 

The main use cases we see for this feature are preventing recipes from providing duplicate information, detecting issues related to specific versions of dependencies, but also performing migrations from one dependency version to the next. We're looking forward to hearing from you about what uses you see for this feature.

As for all Sensei features, more information on the library scope is available in the reference documentation.

According to an IBM study, it is thirty times more expensive to fix vulnerabilities post-release compared to finding and fixing them initially. With that in mind, it’s not surprising that forward-looking CIOs are implementing secure coding practices. This means training and equipping developers to write code that is more secure from the beginning– making them their organization’s ‘first line of defense’. To measure the actual impacts of this trend, Secure Code Warrior teamed up with Evans Data Corp* and commissioned a recent study on developers’ attitudes towards secure coding, secure code practices, and security operations. This research reveals that implementing secure code practices is trans-formative for companies on several different fronts. Download your copy of the whitepaper here.

Secure Coding with more confidence and mindfulness

Without a doubt, implementing secure coding practices raises the security awareness of developers in ways that benefit their employers. Our study reveals that 55% of developers say that good training has increased their confidence in their coding techniques, and 53% said that good training has allowed them to be more careful when debugging and testing their own code. An equal 53% believe they have become more mindful of security when writing code.

What does this tell us? It tells us that with a little bit of upskilling, developers can transform into your first line of defense.

Smarter tool selection + increased release velocity

When we asked managers about the impacts of secure code training, their perspectives reflected their managerial responsibilities. 43% of managers agreed that secure code training has helped their organizations become more careful when debugging and testing their code. 47% revealed that good training has allowed them to be more selective with tooling choices that provide more security. But perhaps most importantly, 44% indicated that secure code training and techniques have helped save time and speed up software releases – a substantial advantage when speed to market is everything.

Enhanced productivity across the board

When we asked developers how secure coding has helped productivity, over half felt it had helped increase both coding and app design quality.  

63% said it reduces rework by preventing recurring vulnerabilities. 70% said it helped eliminate errors that lead to rework or patches. 56% claim that it has improved productivity in Debug and Testing. We can see the transformation underway at multiple stages of the software development life-cycle.

Team dynamics and code quality

Secure code practices also have an impact on team dynamics. While individually, developers learn to code more securely, their code does not exist within a vacuum. Their code is often contingent on the work of others and vice versa. Implementing secure coding practices causes developers to share and seek out secure coding knowledge, driving better communication amongst developers, developers and management, and the development team and their stakeholders.

• 60% of developers surveyed believe that employing secure code practices has increased their communication with other developers
• 45% say that contact with management has increased.

These sentiments are echoed by managers, albeit from a different perspective. 62% of managers surveyed claim that secure code practices require them to spend more time managing people and help increase the velocity of code releases.

For organizations that implement secure code practices, the increase in communication has a trans-formative impact on team dynamics, positively impacting code quality and speed to market.

Transforming from reactive to preventive

Finally, secure code impacts the way developers and dev managers apply security measures and their accompanying metrics.

Today, 81% of organizations still rely on reactive metrics such as defect counts and scanner metrics to determine security quality.

But these reactive activities are increasingly supplemented by or giving way to proactive or preventative metrics. 67% of organizations now measure developer awareness of OWASP Top 10 as a metric for security readiness. Other proactive metrics in increasing use include:

• Measuring developer competency around application security
• Use of pre-approved code
• Compliance with regulatory requirements.

90% of developers now pay attention to these preventative measures. But while awareness and implementation of secure coding practice are growing, there's still some way to go to realize its full potential.

Where to go from here?

As champions of change in secure coding, Secure Code Warrior takes a human-led approach to help you transform your developers into your first line of defense – and your overall security approach from reactive to proactive. Our proven learning platform delivers contextual, hands-on education in 52 language:framework-specific categories, with challenges that mimic those that developers face in the real world. We know from deep experience that developers prefer the learn-by-doing method to the struggle of theory-based static learning. If you’d like to see the trans-formative impact this can have on your teams and their ability to ship quality code with confidence, book a demo now.

‍

*Shifting from reaction to prevention: The changing face of application security. Secure Code Warrior and Evans Data Corp. 2020
1. IBM Software Group; Minimizing Code Defects to Improve Software Quality and Lower Development Cost - https://docplayer.net/11413245-Minimizing-code-defects-to-improve-software-quality-and-lower-development-costs.html

‍

New research explores the benefits of quality security training. 

What are the potential impacts of quality secure code training for your organization – and could it be a worthwhile investment? To find some answers, let's look at some insights from a recent study on developers' attitudes towards secure coding, secure code practices, and security operations, conducted by Secure Code Warrior with Evans Data Corp*. 
‍

When developers and their managers were asked how training has changed the way they code, each cohort responded slightly differently. These differences were in line with how they approach their work and their role within the software development life cycle. Overall though, the underlying theme is that the impact of quality secure code training is overwhelmingly positive. 

55% of developers revealed that good training has increased their confidence in their coding techniques, while 53% said that good training has allowed them to be more careful when debugging and testing their own code. 

Most importantly, 53% believe they have become more mindful of security while writing their code – leading to fewer vulnerabilities and less rework. 

Managers achieving faster software releases

While 43% of managers agree that secure code training has helped their organizations become more careful when debugging and testing their code, the top two changes reflect managerial responsibilities. 47% revealed that good training has allowed them to be more selective with tooling choices that provide more security. While 44% indicated that secure code training and techniques have helped save time and speed up software releases.

Secure coding’s influence on productivity

When it comes to increasing productivity, secure coding practices can have a powerful effect. Asked to identify how secure coding could help to improve productivity, more than 63% of developers revealed that writing secure/quality code reduces rework by preventing recurring vulnerabilities. 70% of developers say that quality training could eliminate errors that later cause reworks or patches. 

Secure coding’s impact on the development life cycle

As developers and their managers integrate secure coding practices into their development life cycles, the real-world impacts of their training can be measured. 

It seems improvements flow across the board, improving productivity right from the start of the SDLC. Over half of all developers surveyed claim that good training has improved productivity application design, coding, and debug & testing.

The debug & testing phase is the most impacted, with 56% of developers saying that they have become more productive with these activities. While better scanning and testing tools may have shortened this phase of development, secure coding practices promote the use and reuse of vetted code that is proven to have no code vulnerabilities, as well as a security-minded approach to designing applications. By “starting left” of the development life cycle with their approach to security, developers can save time during the debug phase.

Deployment, which is further downstream, is less impacted, though 44% of developers reveal that they have become more productive even in deployment. This is a result of the increased release velocity associated with secure coding practices.

A proven path to better training

There’s no doubt that quality secure code training delivers many benefits. The question is, how do you judge the quality of secure code training? 

To find the answer, we asked developers what they wanted. 75% of developers preferred structured on-the-job training. They prefer the learn-by-doing method to the drudgery of theory-based static learning. Developers are on the front lines of battle when it comes to stopping vulnerabilities.  As a result, they want training focused on practical applications – something most current training programs sorely lack.

As champions of change in secure coding, Secure Code Warrior takes a human-led approach to help you create a human-led defense. Our proven learning platform delivers contextual, hands-on training content across 50+ language:frameworks, with challenges that mimic those that developers face in the real world. All of which reduces cost and time to release by preventing vulnerabilities before they become tomorrow’s news.

If you’d like to see the potential impact on your teams and their ability to deliver secure code faster, book a demo now.

If there is such a thing as divine timing, then it must be said that the Biden Administration nailed it with their Executive Order (EO) announcement, addressing the US government’s plan to harden federal networks, as well as improve cybersecurity standards and best practices across the nation. This strategy follows two recent, devastating cyberattacks: the ongoing supply-chain breach from SolarWinds, in addition to the Colonial Pipeline gas infrastructure attack. 

While these events undoubtedly caused ripples throughout every level of government, this directive marks an exciting time for the future of cybersecurity. It seems we are finally getting serious about protecting our digital existence right from the top, and there is no better time to push for better standards and higher quality software than now. 

The EO touches on many aspects of functional cybersecurity, but for the first time, specifically outlines the impact of developers, and the need for them to have verified security skills and awareness. For years, we have shouted from the rooftops that this is the way forward to combat the common vulnerabilities that so often trip us up, and for government mandates to align with this approach is the path to widespread success in cyber defense.

How should organizations - and federal departments alike - respond to this order? Let’s unpack some main categories.

‘Tick-the-box’ is off the table. 

We’ve long pointed out the ineffectiveness of most types of cybersecurity training for developers. It’s often too generic, not delivered in a way that engages and inspires the desired result (read: more secure code), and is touched upon far too infrequently. Worse still, a lot of companies are content with “tick-the-box” training: an approach that delivers the bare minimum, “one and done” basics to fulfill an operational requirement and get a tick next to a developer’s name. These education strategies are what keeps every CISO on a knife edge, crossing their fingers and hoping their company won’t be the victim of the next zero-day breach. They simply do not work to reduce vulnerabilities and create higher-quality code. 

In section 4 of Biden’s mandate, the need for an organization to demonstrate that their developers display documented, verified security compliance is made clear:

‍

“The guidelines shall include criteria that can be used to evaluate software security, include criteria to evaluate the security practices of the developers and suppliers themselves, and identify innovative tools or methods to demonstrate conformance with secure practices.”

There’s a slight problem with that: no industry-standard certification specific to developers currently exists. To be able to benchmark the secure coding skill level of developers, and work with courses and assessments to improve those skills is fundamental, allowing companies to set goals and achieve compliance. When developers can show core competencies in a practical, hands-on environment, this can be assessed and certified in a meaningful, trustworthy way. It’s core to our offering at Secure Code Warrior, and we’ve worked hard to create a system that can be utilized for reliable certification that is customizable to their tech stack and organizational requirements. 

These skills are valuable, and they cannot be automated. Certification can transform developers into a security-aware force that can defend the codebase against insidious threats. 

‍

A focus on developer tooling (and tools in general).

In addition to guidelines around verifying secure coding practices, the EO does quite a deep dive into the automation and tooling side of security. 

There is simply too much code being produced for humans to handle alone from a security perspective, and automation - as part of an extensive tech stack - is a major part of every security program, as it should be. However, not all tools are created equal, and there is no “one tool to rule them all” that will pick up every vulnerability, in every programming language. A great security program takes a nuanced approach, especially when it comes to developer-targeted tools and services.

Section 3 of the EO outlines the expectations for vendors creating software that is eligible for use by the federal government, and instructive guidelines around the use of tools in the development process:

‍

“ (iii) employing automated tools, or comparable processes, to maintain trusted source code supply chains, thereby ensuring the integrity of the code;
(iv) employing automated tools, or comparable processes, that check for known and potential vulnerabilities and remediate them, which shall operate regularly, or at a minimum prior to product, version, or update release.”

Security tools in the developer tech stack are one of the ways to improve security best practices at speed, ensuring that releases have the best chance of meeting deadlines and not being held up by security bugs and other showstoppers. The thing is, however, that developers will still need contextual learning to make the best use of the most powerful tools. For them to understand what has been flagged, why it’s dangerous, and how to remediate it is crucial, and will lead to fewer mistakes for tools to identify in the first place. 

The best tools will integrate with a developer’s environment, assisting them in producing higher quality (and more secure) code, and ensure security stays front-of-mind. 

‍

Securing the supply chain.

One of my favorite parts of the EO is the comprehensive plans to secure the software supply chain. This isn’t surprising, given the SolarWinds event, but it’s an important highlight:

“The security of software used by the Federal Government is vital to the Federal Government’s ability to perform its critical functions. The development of commercial software often lacks transparency, sufficient focus on the ability of the software to resist attack, and adequate controls to prevent tampering by malicious actors. There is a pressing need to implement more rigorous and predictable mechanisms for ensuring that products function securely, and as intended… the Federal Government must take action to rapidly improve the security and integrity of the software supply chain, with a priority on addressing critical software.”

This ruling will affect any software company looking to do business with the US government, but it should be applied as the standard everywhere. Lack of transparency from third-party vendors (not to mention developers making use of third-party components) over their security measures makes it incredibly difficult to assess, validate, and declare that cybersecurity best practices are being fulfilled. We must analyze the suppliers we use and the software they write. These actions may be seen as the “extra mile”, but they should be inherent to a gold standard of cybersecurity best practices.

Shipping secure code with confidence has been a pain point in our industry for a long time, but this is the perfect opportunity to evaluate current processes and lead the charge to hardened software and cloud infrastructure that is the envy of those left behind. Talk to us now and find out how you can leverage Courses, Assessments, and developer tools to certify your next team of security-aware developers.

‍

In our hyper-connected world, almost every organization shares a common Achilles heel.  A single vulnerability, just one exploitable chink in their code, can trigger the theft of customer data, reputational damage and significant financial losses. Organizational alignment around secure coding has never been more imperative – but achieving it is easier said than done.  So in 2020, Secure Code Warrior engaged with Evans Data Corp. to conduct primary research* into developers' and managers’ attitudes towards secure coding, secure code practices, and security operations.

In this environment where cybersecurity is paramount, the traditional KPIs for project success are being redefined – but not quickly enough.

When we asked developers and managers about the most critical priorities in the software development process:

• 76% nominated application performance 
• 62% picked features and functionality
• And a little over 50% selected secure code
  

Today, as we can see, security is not a critical priority. 

But looking to the future, the picture changes dramatically. When asked about the most vital future priorities for measuring project success,79% of developers agree that secure coding will become more critical. In fact, developers see security as the KPI whose importance will increase the most. 

But even though awareness of secure coding is increasing, there are concerns around its adoption. For developers and managers alike, dealing with vulnerabilities and being accountable for code is enough to keep them up at night. Our research* showed that both these groups share the same basic set of concerns, which point to a need for better training in secure coding practices. 

Concerns and barriers around secure coding practices

The number one concern for developers is ‘including code that replicates previous vulnerabilities’. As developers are judged on the quality of their code, this is hardly surprising. No developer wants to be the source of insecure code – or code that requires rework and slows down their team. 

The second most significant concern for developers is dealing with mistakes introduced by coworkers. Meeting deadlines and being accountable for code are also high on the list – as is the fact that learning about secure code is challenging, which echoes developers dissatisfaction with current training approaches.

Managers, on the other hand, take more of a top-down view. Their number one concern is being accountable for bad code or code that replicates previous vulnerabilities.  After all, if their team produces lousy code, the buck stops with the manager. 

The fact that the learning process is challenging comes in third – this is not the only barrier to secure coding practices. 

45% identified a lack of communication between stakeholders and management as a significant roadblock. 42% lament the lack of secure coding skills among new hires. At the same time, 40% nominated inadequate training time and resources. 

Current secure code training approaches are not delivering – and managers realize a new approach is needed.   

Who’s responsible for secure code practices? 

By its very nature, the practice of secure coding means considering security much earlier in the SDLC. It means actively building security in as software as it’s written, from the start, instead of leaving this to later. In other words, to ‘shifting left’. This ‘shift left’ is the essence of secure coding practice. And it means that, ultimately, everyone in an organization should be responsible for secure code. But right now, only 15% of developers agree. 

However, while most developers still see security as someone else's problem, a small but growing cohort not only actively embraces secure coding but champions it within their organization. 29% of developers surveyed agree that such go-to people exist in their workplace. The problem is these secure code champions are still too thin on the ground. 

Creating more security champions 

Development managers are aware of the need to identify and create new security champions and raise the secure coding skills of developers in general. 

Many managers also put a premium on secure coding skills when hiring new developers and value secure coding experience among developers who are already parts of their teams.

83% of managers surveyed say they ask developers to learn or adopt secure coding practices. Roughly three-quarters of surveyed managers say that they provide incentives for developers to engage with secure code training.  These incentives range from formal recognition to greater responsibilities to higher pay. 

It's clear that development managers are critical influencers of the adoption of secure coding practices at the organizational level – and instrumental to spotting security champions.  

But when it comes to creating more of these champions, what motivates developers to learn about secure coding? Our research shows that they see it as means to increase their productivity and efficiency. 

So why don’t developers push for more secure code training? What stands in the way of aligning themselves with a growing organizational need? 

Solutions to begin to address realignment

Developers don't want to sit around listening to lecturers  – they want to get their hands on stuff and try it for themselves. They want a focus on practical applications – something current training programs sorely lack. When asked to identify how company-provided training could improve, 30% of respondents revealed that they would like that training focused on practical applications, particularly authentic work scenarios. 

Current training practices fail to deliver this. A new approach is called for – and as champions of change, Secure Code Warrior takes a human-led approach to help organizations realign around secure coding. Our cybersecurity Courses offer guided learning pathways that include hands-on, 'gamified' coding challenges that mimic those developers face in the real world. 

This training is language:framework-specific, unlike generic training, which often goes in one ear and out the other. 

When it comes to realigning culture, Tournaments can be used to measure coders’ security skills, establish a baseline for future skills development, and spot the potential security champions within your development team. 

If you’d like to know more about secure code training that aligns the needs of managers, developers and the organization towards a secure coding future, book a demo now.

*Shifting from reaction to prevention: The changing face of application security. Secure Code Warrior and Evans Data Corp. 2020

Insecure code costs companies millions – so what gets in the way of adopting secure coding practices? 

In a world that relies on software for just about everything, ensuring that code is secure is critical. Brand reputations and financial viability depend on it. That said, there are many concerns around secure coding – and many barriers to its full and effective adoption. More than ever before, a new way of working is required. So in 2020, Secure Code Warrior engaged with Evans Data Corp. to conduct primary research* into developers' and their managers’ attitudes towards secure coding, secure code practices, and security operations (download whitepaper here).

‍Right now, organizations find it hard to implement secure code practices. Developers and managers alike find dealing with vulnerabilities and being accountable for code particularly concerning.

Clearly, there is a need for better training and a program that supports secure code practices. This need becomes evident when we ask developers and their managers about their concerns around secure coding. Our research* showed that both these groups share the same basic set of concerns. But due to their different roles, they differ on which of these concerns are most pressing.  

The number one concern for developers is ‘including code that replicates previous vulnerabilities’. As developers are judged on the quality of their code, this is hardly surprising. No developer wants to be the source of insecure code – or code that requires rework and slows down their team. 

The second most significant concern for developers is dealing with mistakes introduced by coworkers. Meeting deadlines and being accountable for code are also high on the list – as is the fact that learning about secure code is challenging, which once again echoes the need for a new approach to secure code training. 

Managers, on the other hand, take more of a top-down view. 

As team managers and leaders, their number one concern is being accountable for code. If a team produces lousy code, the buck stops with its manager. 

Code that replicates previous vulnerabilities comes in second. The fact that the learning process is challenging comes in third. As current secure code training approaches are not delivering, managers realize that a new approach is needed.   ‍

Barriers to adopting secure coding practices

When we asked managers about the barriers to adopting secure coding practices in their organizations, two things stand out loud and clear: communication and training. 

45% identified a lack of communication between stakeholders and management as a significant roadblock. 42% bemoan the lack of secure coding skills among new hires. At the same time, 40% nominated inadequate training time and resources. 

There are process and HR-related barriers to adopting secure code practices successfully throughout organizations. 

But you can still make progress despite such intractable issues. The lack of secure coding skills among new hires and inadequate training and resources are easier to address. 

Developers are on the front lines of battle when it comes to stopping vulnerabilities. But are they receiving the support, tools, and training to hold up their part of the security deal?

Based on their concerns, the short answer is 'no'. 

The truth is, the right training shouldn't feel like a lecture. 

As champions of change in secure coding, Secure Code Warrior takes a human-led approach that actively engages developers to learn and build their secure coding skills. Our proven Learning Platform provides development and security teams with contextual and hyper-relevant learning within their preferred workflow. It empowers them not just to find vulnerabilities but to prevent them from occurring in the first place.

This kind of hands-on training is an upskilling opportunity – a career move that only has positives for developers who are serious about stopping vulnerabilities and working with the rest of the team to produce a higher standard of code.

If you'd like to learn more – and see the potential impact on your teams' ability to 'start left' and ship secure code faster without compromising security, book a demo now.

‍*Shifting from reaction to prevention: The changing face of application security. Secure Code Warrior and Evans Data Corp. 2020

Right now, only 15% of developers agree that secure code practices should be everyone’s responsibility. In a world of increasing security threats, that simply isn’t good enough. Something has to be done. One key to creating a healthy AppSec culture is understanding the key influences (and influencers!) at play. So in 2020, Secure Code Warrior engaged with Evans Data Corp. to conduct primary research* into developers' and managers’ attitudes towards secure coding, secure code practices, and security operations.

When it comes to the vital adoption of secure coding practices, certain roles have a growing influence and voice, which can help to compel others to learn and adopt best practice. 

The first of these is the development manager, cajoling AppSec-averse developers towards a secure coding mindset. Development managers are aware that they and their teams need to increase and improve their secure coding skill sets. 42% of surveyed managers bemoan the lack of secure coding skills among new hires. 

The second is the ‘security champion’. While most developers still see security as someone else's responsibility, there is a small but growing cohort that embraces secure coding and champions it to their fellow coders. 25% of developers surveyed agree that there are go-to people leading the change to secure coding.

While these champions may only be a developer or senior developer, they can have an outsize impact on moving an organization towards a proactive security posture.

But first, let’s have a look at the role of the development manager in this context. 

83% of managers surveyed say they ask developers to learn or adopt secure coding practices. Roughly three-quarters of surveyed managers say that they provide incentives for developers to engage with secure code training.  

• 67%  offer developers the potential for greater responsibility as recognition for learning secure coding practices. 
• 47% say that they offer the potential for higher pay. 

Many managers put a premium on secure coding skills when hiring new developers and value secure coding experience among developers who are already parts of their teams.

It's clear that at the organizational level, development managers are critical drivers of the adoption of secure coding practices – and instrumental to spotting security champions in the ranks of their developers.  

Identifying security champions 

One of the keys to improving developer engagement in secure code training and awareness programs is identifying security advocates or champions within the ranks of their current developer cohort. 

Some development managers do this already – 55% of those surveyed say they recognize developers who perform well at special events. 

As champions of change in secure coding, Secure Code Warrior understands the power of special events and competitions to bring out the best in an organization’s developer base. This is why we have made Tournaments a central plank of our Learning Platform. 

Raise security awareness and ownership‍

With a range of challenges, time limits, leaderboards, and prizes, tournaments generate a buzz that makes secure coding cool and promotes security awareness and ownership. 

When it comes to measuring the effect of secure code training, 65% of surveyed development managers say that regular skills assessments drive their organizational focus on secure coding. Tournaments can be used to measure coders’ security skills in an active but safe environment and quickly establish a baseline for future skills development. This gamified training delivers contextual, hands-on experiences in relevant programming languages and frameworks, with challenges that mimic those developers face in the real world.

Throughout the tournament, developers earn points and watch as they climb to the top of the leaderboard. Watching the leaderboard helps management spot potential security champions within their development team.

‍
If you'd like to know more about building secure code skills and awareness with gamified training that engages developers and identifies security champions, book a demo now.

‍

*Shifting from reaction to prevention: The changing face of application security. Secure Code Warrior and Evans Data Corp. 2020

In the last few years, many things have been sacrificed on the altar of speed-to-market—things like network security, terabytes of sensitive customer data and priceless brand reputations. Intense pressure to accelerate the release of new features and functions has led to complex, distributed teams focused on rapid development, with little awareness of the vulnerabilities they could create or the enormous risks. More than ever before, a new way of working is required. So in 2020, Secure Code Warrior engaged with Evans Data Corp. to conduct primary research* into developers' and their managers’ attitudes towards secure coding, secure code practices, and security operations (Download your copy of the whitepaper here).

Performance Indicators for project success – where does security fit? 

Developers and managers think having secure code is important – but just not nearly as important as other factors. When we asked developers and managers  about the most critical priorities in the software development process:

• 76% nominated application performance 
• 62% picked features and functionality
• And a little over 50% selected secure code
  

Compared to other performance indicators for project success, secure coding currently comes in a distant third.

At present – and perhaps unsurprisingly – developers judge a project's success on performance indicators that only assess the code after the project is finished. 

However, when asked about how this might change in the future, the picture flips on its head. How organizations approach security as a metric for success is changing. Secure coding is becoming a greater priority. 

When asked about the most critical priorities for measuring project success in the future, 79% of those surveyed agree that secure coding will increase in importance. What’s striking is that a more significant percentage see security's importance in the future increasing more than that of any other performance indicator.  Awareness of secure coding is growing, as is a movement to ‘shifting left’. By its very nature, the practice of secure coding means considering security much earlier in the SDLC. It means actively building security in as software as is written, from the start, instead of leaving this to later. 

As CIOs strive to make their organizations more agile, secure coding capabilities will become a vital innovation weapon. CIOs and CISOs should think carefully about whether their development teams are the first line of risk or their first line of defense. 

This insight has critical implications for how organizations train their developers. Teams need to learn about recently identified vulnerabilities and learn in their own languages/frameworks. In short, they need to understand how to locate, identify and fix known vulnerabilities in code in the context they work in every day. 

As champions of change in secure coding, Secure Code Warrior takes a human-led approach that actively engages developers to learn and build their secure coding skills. If you'd like to see the potential impact on your teams' ability to start left and ship secure code faster without compromising security, book a demo now.

‍

‍*Shifting from reaction to prevention: The changing face of application security. Secure Code Warrior and Evans Data Corp. 2020