Did you know that 67% of developers admit to shipping code with vulnerabilities? Imagine a team of construction workers tasked with building a house. They have all the materials and tools they need, but they are struggling to follow the blueprints and building codes. As a result, they are making mistakes and the house is not being built to code.

This analogy can be used to illustrate the challenges that developers face when trying to practice secure coding. Just as construction workers need to follow blueprints and building codes to ensure that their houses are safe, developers need to follow secure coding practices to ensure that their software applications are secure.

There are a number of reasons why secure coding can be challenging. These include:

• A lack of awareness of secure coding practices. 86% of developers state they find it challenging to practice secure coding.‍
• A lack of time and resources. 24% of respondents in our survey stated ‘not enough time’ is the biggest impediment to integrating secure code.‍
• The complexity of secure coding. 63% of developers rate writing secure code that is free from vulnerabilities to be difficult.‍
• Over reliance upon tools. 57% of application security teams are utilizing six or more tools to discover vulnerabilities during the DevSecOps lifecycle. (GitLab, 2023)

However, despite the challenges, secure coding is essential. By following secure coding practices, developers can help to protect their applications from vulnerabilities that can be exploited by attackers. Just as a well-built house is less likely to collapse, a well-coded application is less likely to be hacked.

Here are a few tips for developers who want to improve their secure coding practices:

• Get training and education on secure coding. There are a number of resources available to help developers learn about secure coding practices.
• Use static analysis tools to identify vulnerabilities in code. Static analysis tools can help to identify vulnerabilities in code that may be difficult to find manually.
• Write code that is easy to review and understand. Code that is easy to review and understand is more likely to be secure code.
• Test code thoroughly. Testing code can help to identify and fix vulnerabilities before they are exploited.

Interested in learning more? Unlock the secrets to developing an agile secure coding strategy with our secure code learning blueprint. 

‍

‍

‍

‍

In the dynamic realm of software development, agility is not just a buzzword; it's a necessity. Recognizing the ever-changing landscape, developers must adopt a mindset of continuous learning to further optimize Mean Time to Remediation (MTTR). Agile learning involves the ability to quickly adapt to new technologies, methodologies, and problem-solving techniques around secure coding. In this blog, we’ll explore how embracing agile learning can become a pivotal factor in reducing MTTR and enhancing overall development efficiency.

Challenges faced by developers in reducing mean time to remediation (MTTR)

The mean time to exploit vulnerabilities in 2023 stands at 44 days, but 75% of vulnerabilities were exploited within 19 days of publication. This should serve as a wake-up call to adopt a proactive stance toward patch management, threat intelligence, and education for developers.

Developers face an array of challenges in identifying and resolving issues due to the intricate web of tools and systems, gaps in communication, and a lack of skills to tackle an issue that needs immediate attention. Below, you can see some of the challenges developers face when remediating a vulnerability. 

Complexity of systems and lack of automation:

• Modern applications are often composed of microservices, APIs, and various third-party integrations. Identifying the root cause of an issue in such complex systems can be challenging and time-consuming. Manual processes for issue detection, analysis, and resolution can be time-intensive. Lack of automation can hinder the speed at which developers can respond to incidents.

Limited Visibility and communication:

• Developers face many difficulties in obtaining real-time insights into system behavior and performance. This can impede their ability to quickly identify and address issues.
• Efficient communication is crucial in issue resolution. Siloed communication channels and lack of collaboration between development, operations, and other teams can lead to delays in addressing problems.

Lack of skills needed to remediate an issue quickly:

• Without a proper grasp of secure coding practices, developers may struggle to apply effective patches, introduce new flaws unintentionally, and overlook critical security controls. This lack of understanding can impede collaboration with security experts and lead to incomplete or ineffective fixes, increasing the risk of security threats in the codebase. 

The agile learning advantage 

Agile learners are adept at acquiring new skills. As technologies evolve and systems become more intricate, developers need to stay ahead of the curve. Investing in a continuous learning platform will empower the team with the latest troubleshooting and debugging techniques.

1. Adaptive Problem-Solving

Agile learners thrive in environments where problem-solving is an iterative process. By fostering a culture that encourages experimentation and learning from failures, development teams can enhance their ability to address complex issues promptly.

2. Cross-Functional Collaboration

Agile learning goes hand-in-hand with cross-functional collaboration. Developers, security, and other teams must not only share knowledge but also collectively learn from each other's experiences. This collaborative mindset accelerates issue resolution by tapping into a diverse range of skills and perspectives.

3. Integrate learning into the developer workflow: 

Implement short, focused learning sprints within the development cycle. These sprints can be dedicated to exploring new technologies, tools, or problem-solving methodologies. By allocating time for continuous learning, teams can proactively build the skills required to tackle emerging challenges.

4. Multiplying security champions:

Foster a culture of security within the team with experienced developers leading the charge. They can guide less experienced team members, sharing their knowledge and providing valuable insights. This mentorship not only accelerates the learning curve but also creates more security champions. 

With these core principles in mind, Secure Code Warrior customers have seen significant gains in improving mean time to remediation. This can be measured in days, where one client has seen a reduction of 150 days to fix. Or it can be measured in time to fix. For example, learn how Sage reduced one team’s time to fix by 82% with Secure Code Warrior. 

Conclusion 

When it comes to optimizing MTTR, agile learning for secure code emerges as a catalyst for continuous improvement in resolving persistent vulnerabilities. By instituting a culture that values adaptability, encourages continuous learning, and facilitates cross-functional collaboration, development teams can not only meet the challenges posed by the ever-evolving software landscape but also surpass them. As we navigate the complexities of software systems, let agile learning be the compass guiding developers towards faster issue resolution and sustained success.

‍

A little over nine years ago, I had several conversations with friends, family, ex-colleagues, and potential investors about my intention to start a company. All were supportive, some became the angels we needed to bootstrap our way into existence, and others, well, they acted as the voice of reason, quoting sobering statistics like 90% of startups eventually failing, with one in five succumbing to the scrap heap within the first two years. 

The journey to date has not been without hurdles, unpredictable economic headwinds, and significant risk, but truly, with my co-founder Matias and an incredible team by my side, I feel we can withstand almost any curveball thrown our way. 

Today is our ninth birthday, and I remain immensely proud and grateful for our achievements and enduring place in cybersecurity land as the scene continues to change rapidly. 

‍

New clients, new opportunities

It’s not easy to grow in this economic climate, but we continue to find ways to improve speed, efficiency, and deliver more value to our expanding customer base. While we added a plethora of tier-1 logos to our client list in 2023, the real boon was in witnessing their willingness to try new approaches to secure software development, even in legacy environments where this can be significantly more difficult to roll out. 

These big players in the industry can be instrumental in driving the change we must see if we want to witness a transformation in security outcomes. 

And in 2023, we were delighted to observe:

>> 100% growth for our annual Devlympics global secure coding tournament. Save the date and register your interest for our 2024 tournament, beginning on October 15!

>> Over 400,000 developers using the Secure Code Warrior Learning Platform.

>> Data analyzed from 30% of our user base - almost 75,000 individuals - revealing that developers who learn and apply secure coding practices with Secure Code Warrior introduce 53% fewer vulnerabilities into their organization than their peers. Awesome!

AI is dominating headlines and boardrooms, but we are ready

The hype around AI, machine learning and large language model (LLM) technology was inescapable last year, and in just twelve short months, an onslaught of AI coding and security tools has started to change the way in which many developers approach writing code.

Emerging technologies that manage to capture the zeitgeist of the moment and demand mass adoption are incredibly powerful, and AI assistive coding tools are here to stay. However, as we have discussed at length, such technology has, if anything, widened the chasm between secure software development and efficiency. Security-skilled developers are more in demand than ever as organizations contend with the need to balance speed with contextual awareness and vulnerability detection, the latter of which is best done with experienced human oversight. In some ways, it’s the future of pair programming, and the tools themselves present a new, unique frontier in software creation.

You can play an interactive challenge to witness the security impact of AI/LLM tools for yourself, and see the immense opportunity here to place emphasis on developer security upskilling sooner rather than later. And we’re ready to partner with organizations that seek speed and efficiency with security at the forefront.

Standing beside cybersecurity leaders to create developer-driven, positive security outcomes

For nine whole years, we have championed software engineers as the beating heart of a security program, and as we enter a decade in this space, 2024 is shaping up to be a revolutionary year in our history.

Our product roadmap is brimming with amazing new features that we can’t wait to share with you, and I know that security leaders will be especially interested in what we can help them achieve with their development cohort. 

Stay tuned, and thank you for walking with us.

A version of this article appeared in Forbes. It has been updated and syndicated here.


‍The Cybersecurity Strategic Plan pushes major changes to the way most organizations approach cybersecurity, and developers are in a unique position to help achieve those new goals.

‍

The Cybersecurity and Infrastructure Security Agency (CISA) has not only been instrumental in safeguarding the critical infrastructure and computing networks of the United States since its inception in 2018, but its influence and expertise have also reverberated globally. The agency's comprehensive advice, security advisories, vulnerability reports, and cybersecurity programs have set a global benchmark for actionable best practices, underscoring the significance of the newly released CISA 2023-2025 Strategic Plan in the realm of global cybersecurity.

CISA’s influence and accomplishments have also spread far beyond what most government agencies have been able to accomplish, especially considering that it has only been around for a few years. This is in no small part because of the exponential growth of the threat landscape and the fact that attackers are becoming more skilled in their breach and exploitation attempts. CISA has taken on a leadership role in the fight against cyber criminals and other so-called threat actors, methodically tracking trends and advising on best practices for cybersecurity.

However, for all of the agency’s helpful advice and guidance, it has never before released an overall strategic plan designed to set the overall direction for cybersecurity efforts over the next several years. This is not just another plan, but a milestone that many organizations will want to study and ultimately implement. The fact that the plan calls for major changes to the way cybersecurity is approached might make following that guidance challenging, although the development community is in a unique position to help out if given the right support, tools, and upskilling pathways.

A change is in the air for global cybersecurity best practices

At first glance, it would be easy to perceive some level of frustration in the CISA Strategic Plan, but CISA is simply acknowledging the fact that if we keep doing the same things we are now, we will keep seeing the same results. For cybersecurity to get better, it will require major changes across the board, including from companies that make the software and applications being used today.

Pointing the finger at software, at least partially, is a concept that has been introduced previously. In fact, the National Security Strategy of the United States specifically states that “poor software security greatly increases systemic risk across the digital ecosystem.” The CISA Strategic Plan lays out a new strategy for approaching and solving that predicament.

The biggest change in cybersecurity being advocated by CISA is to challenge those making software to ship secure products. If secure coding best practices are established and put in place, then there will be far fewer vulnerabilities, especially major ones, lurking within software for attackers to exploit. Yes, something here and there could still be overlooked and will require diligence to find and fix, but that is a manageable proposition compared to the current status quo: hundreds of vulnerabilities detected every day overloading cybersecurity defenders. CISA states very clearly in its plan that those who make software and other technologies need to be accountable for the security of their own products.

“As a society, we can no longer accept a model where every technology product is vulnerable the moment it is released and where the overwhelming burden for security lies with individual organizations and users,” the CISA Strategic Plan states. “Technology should be designed, developed, and tested to minimize the number of exploitable flaws before they are introduced to the market.”

The plan goes on to suggest that eventually, this new approach might be more than suggestive, saying that CISA will use “all available levers to influence the risk decisions of organizational leaders.” It also hints that laws like the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA), which currently governs the reporting of cyber incidents, could act as a model to eventually shift voluntary compliance with these new regulations to becoming more mandatory. In any case, it would benefit most companies making software and other technology today to try and get behind this new guidance.

CISA's guidance represents a key opportunity

Instead of feeling apprehensive at the prospect of more potential regulations, organizations should instead embrace the opportunity to use the CISA Strategic Plan to strive for better, higher-quality software. This is not just a call for compliance, but a chance for developers to hone their skills and contribute to a more secure digital landscape. Ultimately, producing secure software helps everyone including the company that makes it, the users who come to depend on it, and the people whose data is accessed or stored by that piece of software or application. Only the attackers are left empty-handed if the code that makes up the majority of software and applications is made as secure as possible before heading over to a production environment.

Given this new direction, it makes sense that an organization’s developers, who write or source all the code, are a perfect place to start when it comes to implementing more secure coding and efforts to comply with the CISA plan. But developers can’t do it alone without the support of the rest of their organization, especially upper management. Having developers who understand vulnerabilities, how to write secure code and how to recognize problems long before they get to a production environment will be the key to organizations ultimately taking responsibility for shipping code and, as CISA puts it, “ensuring that vulnerabilities are discovered and fixed before adversaries can use them to cause harm.”

One key thing to note is the training that developers need is fairly advanced. It’s a challenging endeavor for someone to become proficient in consistently writing secure code, and check-the-box compliance measures are simply not up to that task. Developers will require high-level, agile learning methods that offer hands-on, digestible, and continuous learning outcomes as part of an overall security awareness program in order to ensure that they have the skills needed to maintain the level of security required by the new CISA plan. 

Ideally, upskilling to get ready for the CISA plan should also incorporate many of the advanced methods and programs that developers use every day, such as the principles of Agile development. For example, in Agile development, work is broken down into manageable chunks, layering sprints on top of one another in a continuous cycle. A good education program that incorporates Agile practices can help developers quickly get up to speed with the skills needed to support the CISA plan, allowing them to start seeing benefits and begin coding more securely almost immediately.

The good news is that most developers support secure coding practices and are eager to help their organizations comply with the new CISA directive. In a survey of over 1,200 professional developers actively working around the world, the overwhelming majority said they were supportive of the concept of creating secure code and establishing a better security culture at their organizations. 

Developers need precision education pathways and adequate support. If organizations can provide that, not only will their code become more secure, but they will be ahead of the curve in their efforts to comply with or surpass the guidance set out in the new CISA Cybersecurity Strategic Plan.

This proposed shift in security culture will be challenging, but it’s also an incredible opportunity to change the nature of cybersecurity and create a world where the technology that makes all of our lives better is not also plagued by attackers constantly trying to exploit it for their own nefarious ends. We have the power to stop them, and the CISA plan shows a promising path toward that remarkable and ultimately achievable goal.

A version of this article originally appeared in DZone. It has been updated and syndicated here.

The Payment Card Industry Data Security Standard (PCI DSS) version 4.0 will change almost everything about security for any business or organization that accepts electronic payments, which is a vast majority of them. And make no mistake, this update will be transformative for most businesses, requiring them to upgrade many of their security processes and potentially roll out new protections regarding encryption, authentication, access control, key management, and other areas that they may have been slow to embrace before now.

Due to the complexity of the new requirements, organizations have been given until March 2025 to become fully compliant. But that deadline will arrive sooner than most people realize. In fact, many forward-thinking companies are taking steps right now to enable their developers to navigate the pending compliance landscape. 

Going beyond check-the-box training

An organization’s developers write the code that much of their infrastructure relies on, so it makes sense that they are a good place to start when it comes to implementing the new PCI DSS 4.0 requirements. However, most developers will need strategic support to upskill as part of an updated security awareness program. This is to ensure that they have the experience needed to implement and maintain the higher levels of security required by the new standard. 

In fact, requirement 12.6.2 of PCI DSS 4.0 directs organizations to implement a formal security program, and to keep it updated with the latest threat information and defensive techniques. With the older standard, basic security programs or even “check-the-box”-style annual compliance training met the objective. This new standard mandates so much more, even requiring that security training programs address specific threats and vulnerabilities within a company’s environment. For example, if stolen identities are a big problem for an organization, then the training needs to address that.

It's clear that minimal training will no longer be adequate from either a practical standpoint or for complying with the new standard. Instead, organizations need to provide developers with comprehensive, agile learning pathways that teach them how to apply security best practices to their real, everyday work. By going beyond minimum compliance efforts and providing developers with the resources they need to truly understand security, organizations can empower their developers to make better security decisions overall while also complying with PCI DSS 4.0.

The good news is that many of the new requirements in PCI DSS 4.0 are targeted toward areas that most developers are already familiar with like authentication, encryption, access control, key management, and others. When developers are given right-fit, relevant and familiar resources to grow their skills, organizations can more easily prepare them for the new standards and increased responsibilities that PCI DSS 4.0 will require.

Using PCI DSS 4.0 as a runway to better security overall

While addressing developer needs with good security education will be key to successfully complying with the new PCI DSS 4.0 standard, the effort of moving an organization towards better cybersecurity does not need to end there. Yes, the requirements are rigorous, but since most organizations will need to work to comply with them, there is no reason not to use that effort as a springboard for launching better security awareness and training overall. This will not only help an organization meet compliance requirements, but also start to foster a culture of positive security that prioritizes best practices and ensures that everyone in the organization is working towards the same, security-first goal. 

There is a learning curve, sure, but developers will likely be on board with such an effort. In an Evans Data survey of over 1,200 professional developers actively working around the world, the overwhelming majority said they were supportive of the concept of creating secure code and establishing a better security culture at their organizations. It’s clear that most developers welcome a strategic, supported shift to secure coding and a reprioritizing of security as part of the development process. 

The security upgrades mandated by PCI DSS 4.0 provide a perfect excuse for companies to invest in improved security best practices and training, and to embrace a better overall security culture within their organization.

Developers can more easily achieve higher levels of security maturity if their companies invest in a program that lets them integrate their skills in secure coding with relevant tools and training. This can, in turn, help to create a culture of security where developers are further empowered to make better decisions that improve their organization’s overall security posture well beyond even the rigorous new PCI DSS 4.0 standards.
‍

We’ve hit that time of the year. The time to reflect on everything that’s happened, what we thought would happen and didn’t, lessons learned and what we expect will shape the decisions, actions and outcomes over the next 12 months. 

Challenging economic dynamics, emerging cybersecurity threats, and society’s most accessible introduction to AI to date, shaped what was an interesting 2023 for DevSecOps. Even more curious – none of these elements are in the rearview mirror as we turn the page and head into 2024. They are front and center for organizations, their developer and cybersecurity teams, and government regulators. 

As priorities shift at a rapid pace, here are the top predictions Secure Code Warrior sees unfolding in the next 12 months: 

Organizations will place a premium on developer retention 

Developers deliver immense value to organizations and their customers. Now it’s on the organizations to demonstrate their value and appreciate what the developer can do for their bottom line. More investment will be made in retention strategies, programs and other efforts to ensure developers are more empowered to make their current employer their long-term career destination. Learning and development will be a huge differentiator for these enterprises. 

More asks of developers will put content and integrations at centerstage. 

The pressures placed on developers will not let up anytime soon, knowing organizations want more software, and continuous digital transformation to get into the hands of their customers sooner. For developers to stay sharp, anticipate emerging roadblocks in software development life cycles (SDLC) and have access to more resources to accelerate innovation - more learning content and third-party integrations will be of paramount importance. 

AI tooling is the new Stack Overflow 

The same way developers go to Stack Overflow or open source forums to seek help, developers will start turning to AI tools. However, this creates a false sense of security. Developers will use AI as a “help channel,” but organizations will realize that this approach is not enough. 

AI remediation is here to stay 

AI is not replacing the developer tomorrow, but the technology is becoming more embedded in the software development life cycle (SDLC), creating a more foolproof process to avoid introducing vulnerabilities, or to identify a compatible fix. We’re bound to see more experimentation throughout the year that will inevitably bring about a change in developer behavior, organizational investment, staffing re-allocation and new approaches to cybersecurity risk management. 

AI reliance + API explosive growth = regulatory measures

The number of companies fueling their businesses through the accelerated creation and enablement of APIs has significantly expanded the API threat vector. With the propensity of AI usage to exponentially increase the speed at which APIs are created and launched, greater governance for API security will need to be a focus – and new regulatory measures are sure to be introduced. 

More consequences for software vendors who don’t ship secure code 

CISA Director Jen Easterly has made it abundantly clear that software vendors should not be permitted to “pass the buck” when it comes to security within their products. While CISA’s powers only extend so far - helping to enforce Secure-by-Design practices to vendors that sell to federal agencies - The MOVEit incident earlier this year reaffirmed that large software vendors need to hit and exceed a new benchmark. There needs to be more accountability and more consequences to enforce for repeat offenders who ship insecure code.

2024’s OWASP Top 10 will show a renewed focus on design flaws 

Speaking of Secure-by-Design, In 2021, OWASP introduced the “Insecure Design” category, focusing on the shift towards architectural security issues and flaws. As we anticipate their upcoming Top 10 list (most likely in 2024), there will be greater, executive-level conversation around the difference between insecure design and insecure implementation, with an emphasis on teams developing a secure software development life cycle (SSDLC), including a complete threat modeling procedure that supports critical authentication and access control configuration. 

DevSecOps vendors will need to prove specific ROI to target different executive buyers 

In order to sell to multiple groups in a competitive sales cycle, vendors will need to tailor conversations to different areas of the business. Traditionally, security vendors primarily sell to CISOs or security leadership. In 2024, there will be a greater need for the ability to prove risk reduction in increasingly specific contexts for executives across L&D and DevOps/AppSec – in addition to Security/CISOs.

“Gatekeeping” will be the ticket to security maturity in software development 

CISOs remain under scrutiny to prove the business value of cybersecurity efforts, as well as the effectiveness of their program over time. Developers will increasingly need to prove they are security-aware before being given projects with sensitive repositories. CISOs who adopt a “gatekeeping” standard and prioritize secure coding from the start of the software creation process will better position their teams for security excellence. 

Reactive security will be seen as old school 

As the goal of increased cyber resilience continues to dominate cyber strategies across multiple verticals, those who rely on reaction and incident response as the only core tenets of their plan will find themselves in a place of unacceptable exposure and risk. “Shift left” needs to be more than a rapidly aging buzzword; code-level security should be prioritized, alongside upskilling and verifying the competence of the developers working on the software and critical digital infrastructure we take for granted. Now, more than ever, governments and enterprises alike must commit themselves to a preventative, high-awareness security program in which every member of staff is enabled to share responsibility.

As the leader in secure coding education and implementation, we’re excited for the year ahead and collaborating with our 600+ customers to get ahead of these evolving dynamics. What does your 2024 look like and how can Secure Code Warrior help?

Interested to learn more? Follow us on X and LinkedIn to stay up-to-date on all announcements.

The speed of innovation in cloud computing and AI is at an all time high. Global SASE leader Netskope helps organizations take advantage of it all while addressing evolving threats, new risks and technology shifts. However, these challenging dynamics have placed added pressures on the software development lifecycle.

Netskope’s Deputy CISO, James Robinson, has been at the forefront of finding ways to ensure his organization’s development team stays up to speed on new languages and technologies, but also keeps the team skilled on the ever-evolving security landscape. When he recognized that current training capabilities only addressed a handful of languages, it was obvious a better alternative was needed.

In working with Secure Code Warrior, they have built a program that makes security content visible and accessible to developers, so they won’t wander to unvetted solutions.The customizable content and myriad of hands-on learning activities from Secure Code Warrior has changed the game for Netskope, with a higher participation in SCW’s agile learning platform and the fact that these efforts no longer feel like they’re a check-the-box – but meaningful content and activations for the developer community.

What was their complete journey like and what have been the results thus far?

• Check out Netskope’s story in this brand-new case study you can read here
• Watch a joint webinar with Secure Code Warrior and Netskope on Going beyond compliance here 

No matter where you look, there is an ongoing fixation with AI technology in almost every vertical. Lauded by some as the answer to rapid-fire feature creation in software development, the gains in speed come with a price: the potential for severe security bugs making their way into codebases, thanks to a lack of contextual awareness from the tool itself, and low-level security skills from the developers relying on them to boost productivity and generate answers to challenging development scenarios. 

Large Language Model (LLM) technology represents a seismic shift in assistive tooling, and, when used safely, could indeed be the pair programming companion so many software engineers crave. However, it has been quickly established that unchecked use of AI development tools can have a detrimental impact, with one 2023 study from Stanford University revealing that reliance on AI assistants was likely to result in buggier, more insecure code overall, in addition to an uptick in confidence that the output is secure.

While it is valid to assume that the tools will continue to improve as the race to perfect LLM technology marches on, a swathe of recommendations - including a new Executive Order from the Biden Administration, as well as the Artificial Intelligence Act from the EU - renders their use a tricky path in any case. Developers can get a head start by honing their code-level security skills, awareness, and critical thinking around the output of AI tools, and, in turn, become a higher standard of engineer.

How do AI coding assistants introduce vulnerabilities? Play our NEW public mission and see for yourself!

‍

Example: Cross-site scripting (XSS) in ‘ChatterGPT’

Our new public mission reveals the familiar interface of a popular LLM, and utilizes a real code snippet generated in late November 2023. Users can interpret this snippet and investigate any potential security pitfalls if it were to be used for its intended purpose.

Based on the prompt, “Can you write a JavaScript function that changes the content of the p HTML element, where the content is passed via that function?” the AI assistant dutifully produces a code block, but all is not what it seems.

Have you played the challenge yet? If not, try now before reading further.

… okay, now that you’ve completed it, you will know that the code in question is vulnerable to cross-site scripting (XSS). 

XSS is made possible by manipulating the core functionality of web browsers. It can occur when untrusted input is rendered as output on a page, but misinterpreted as executable and safe code. An attacker can place a malicious snippet (HTML tags, JavaScript, etc.) within an input parameter, which -- when returned back to the browser -- is then executed instead of displayed as data.

Using AI coding assistants safely in software development

A recent survey of working development teams revealed that almost all of them - or 96% - have started using AI assistants in their workflow, with 80% even bypassing security policies to keep them in their toolkit. Further, more than half acknowledged that generative AI tools commonly create insecure code, yet this clearly did not slow down adoption.

With this new era of software development processes, discouraging or banning the use of these tools is unlikely to work. Instead, organizations must enable their development teams to utilize the efficiency and productivity gains without sacrificing security or code quality. This requires precision training on secure coding best practices, and providing them the opportunity to expand their critical thinking skills, ensuring they are acting with a security-first mindset, especially when assessing the potential threat of AI assistant code output. 

Further reading

For XSS in general, check out our comprehensive guide.

Want to learn more about how to write secure code and mitigate risk? Try out our XSS injection challenge for free.

If you’re interested in getting more free coding guidelines, check out Secure Code Coach to help you stay on top of secure coding best practices.

‍

In the ever-evolving landscape of cybersecurity, the role of developers in safeguarding digital assets has become increasingly pivotal. However, the challenge lies in educating developers who, inherently focused on problem-solving and efficiency, may not prioritize security. In this blog post, we explore three critical steps to structure a security education program that not only engages developers but also significantly reduces vulnerabilities—by a remarkable 53%. From fostering relationships to implementing a tiered approach, these strategies aim to empower developers with the knowledge and skills necessary for secure coding practices.

1. Build relationships and keep developers engaged 

Developers often lack initial security knowledge, but their primary focus lies in resolving code-related issues promptly. To spark their interest in security, it's crucial to emphasize the value of these topics and make them actionable. Implementing a program that allows developers to train independently and at their own pace across all programming languages in your technology stack is key. Establish strong relationships with developers and team leads to allocate realistic time for secure code education.

The critical first step is to  implement a program that allows developers to be independent and train at their own pace. This means it needs to cover all programming languages used in your technology stack. Take into consideration the learning needs of developers in a complex environment and think about how it will work alongside your existing security tooling to aid in vulnerability management.

2. Prioritize recurring vulnerabilities  

Using your scanning and pen-testing tools, keep a close eye on your critical and recurring vulnerabilities to guide you on which secure coding educational content will build the cornerstones of your program. Utilizing your existing tools and integrating these findings into your secure code program will be key. Consider also the following metrics to prioritize which vulnerabilities your developers need to be educated on: 

• Average vulnerability age 
• Number of vulnerabilities in the backlog
• Average resolution time, or mean time to remediate (MTTR)  
• Number of closed vulnerabilities vs. open vulnerabilities
• Number of issues per line of your proprietary written code (not third party)

Expectations around the outcome of the program should be set early on as well. Developers who participate in the program should be expected to attain a certain level of secure coding skills, which can be tracked by the number of vulnerabilities they resolve and are not re-introducing. 

3. Implement a tiered secure coding skill development program 

Once you have integrated developers’ participation in security with the analysis and testing process, it’s time to empower developers to be proactive about honing their secure coding skills by incentivizing them to continue with their secure coding education. This can be done by structuring your program into tiers, or “belts” to move developers into more complex areas of security. 

Here’s one example of how Thales structured their security education program: 

1. Awareness - raises the basic level of security awareness and establishes a baseline for the developers’ knowledge of the security topic 
2. Basic - teaches basic security skills like how to spot vulnerable code and understand common vulnerabilities 
3. Autonomous - uses vetted tactics to locate and remediate vulnerabilities with Secure Code Warrior’s guidance 
4. Expert - becomes a defined security champion and expert in all relevant areas important to the business

Promoting self-learning will also motivate your developers to keep them up to date on new attack vectors, best practices, new languages, and newly discovered vulnerabilities. Once everyone has reached a baseline of secure-coding competence, take advantage of a program that helps save time with just a couple of key learnings every month through relevant content, rather than an hour-long compliance-oriented annual training. The time saved through educating developers will manifest in the reduction of rework needed to fix vulnerabilities that shouldn’t have been introduced in the first place. 

Conclusion

In the dynamic realm of cybersecurity, where threats mutate as swiftly as technology advances, a proactive and well-structured security coding education program for developers  is a critical business safeguard. By building strong relationships with developers, prioritizing recurring vulnerabilities, and implementing tiered skills development, organizations can fortify their codebase against a potentially devastating breach. 

The success of such a program is not merely measured in reduced vulnerabilities but in the cultivation of a security-first mindset among developers. As we navigate the complex terrain of digital security, empowering developers through education emerges as a potent strategy for transforming an organization into a resilient and secure digital ecosystem.

Secure Code Warrior is here to help you securely code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.