A sure way to improve your organization’s security posture is through developer upskilling in secure coding best practices, delivered in a framework that includes baselines and benchmarks designed to give developers the specific learning pathways they need. Secure coding, however, is not a one-time fix—it must become a way of life, encoded into an organization’s DNA. Developers not only have to shift left, or start left, but they need to stay left. 

Simply providing training isn’t enough. Organizations need to confirm that developers have completely absorbed their training and are following best practices at the beginning of the software development lifecycle (SDLC) as part of their everyday routines. You need to track developers’ performance and measure their progress against both internal standards and industry benchmarks, effectively measuring the ROI of investing in training.

Secure Code Warrior’s Trust Score provides visibility into the performance of individual developers and aggregates the data to provide an assessment of your organization’s overall performance. It shows the effectiveness of upskilling programs while identifying areas in need of improvement. And, it helps ensure compliance with the range of regulatory compliance requirements, whether they come from the General Data Protection Regulation (GDPR), the Payment Card Industry Data Security Standard (PCI DSS), the California Consumer Privacy Act (CCPA), or others.

Our research has shown that secure code training works. Trust Score, using an algorithm drawing on more than 20 million learning data points from work by more than 250,000 learners at over 600 organizations, reveals its effectiveness in driving down vulnerabilities and how to make the initiative even more effective.

Training Improves Security – If Developers Get It 

For years, using security best practices at the start of the SDLC seemed to be mostly aspirational in the software industry—great to have someday, but not a priority for today. But the ever-increasing speed of software development, along with the accelerating pace of sophisticated and destructive cyber threats—often built on targeting software vulnerabilities—have made secure coding essential. The Cybersecurity and Infrastructure Security Agency (CISA) puts secure code front and center with its Secure-by-Design initiative, which is growing into an international movement. 

Our research has proved the point—the correlation between a Secure-by-Design approach and a reduction in software vulnerabilities is clear. We analyzed vulnerability reduction data from 26% of SCW’s customer base and found that developer training resulted in reductions of software vulnerabilities ranging from 22% to 84%. That range resulted from variables such as the size of the companies involved (smaller companies with relatively few developers produced a more dramatic range of results), and whether a learning group was focused on a specific problem, in which case they eliminated a higher percentage of flaws.

The results with large companies were rather consistent. Companies with 7,000 or more developers can expect to see vulnerabilities reduced by 47% to 53% as a result of developer upskilling in security. For example, one statistically average company with more than 10,000 developers—not a top performer on the platform nor one with the highest benchmark—saw a 53% reduction in vulnerabilities. 

Of course, the most effective training doesn’t take a broad, one-size-fits-all approach. It should be tailored to developers’ work environments and the types of development they do.

Companies should start by establishing the baseline skills developers must have to make writing secure code as natural to them as simply writing code. Upskilling programs should consist of hands-on, agile training in real-world scenarios that match the type of work they do and the languages they use. And it should be flexible enough to fit training sessions into their work schedules. 

For developers, the skill set involves more than writing code. They need to be able to check software created by artificial intelligence assistants and third parties, such as open-source repositories. Developers have made avid use of generative AI models, and they have generally lauded its benefits in helping them create more code more quickly. However, although 76% of respondents to a Snyk survey said that AI-generated code was more secure than code produced by humans, 56.4% still said that AI introduces errors sometimes or frequently. And the same survey found that 80% of developers skip applying AI code security policies, suggesting that code issues in AI code are not being addressed.

In a Secure-by-Design approach, developers—working with security teams, rather than separately from them—will address those issues early in the SDLC, identifying and remediating flaws before code goes into production.

Trust Score Measures Individual and Enterprise Performance

It’s also critical that training is ongoing. Companies need to adopt a security-first culture that applies everywhere from the highest echelons of the company on down through the ranks. It should focus on continuous improvement and the application of best security practices throughout the SDLC. Technology and cyber criminals don’t stop evolving; neither should cybersecurity. For organizations that produce software, security-trained developers are the foundation.

That’s why demonstrating that training has effectively taken hold is just as important as the training itself. Trust Score not only delivers visibility into the performance of developers individually and the organization overall, it enables organizations to drill down through performance data to focus on specific languages, developer teams or software categories. The data from individual and aggregated performance results also helps identify areas where training needs to be improved—for example, if it isn’t having the desired effect on developers’ everyday performance.

Trust Score has empowered organizations to assess developers’ performance and confirm whether they have acquired—and are using—the necessary security skills, ensuring they have earned their license to code. It allows organizations to confidently grant qualified developers access to their most sensitive data and critical software projects, while denying that access to those on the tools who aren’t quite ready yet.

Proof of a Changing Security Culture

Cybersecurity is no longer just a security issue. It’s a business issue, affecting the integrity of the most valuable asset of many organizations — their data. A serious breach affects an organization’s operations, reputation and, potentially, its viability. Cybersecurity’s importance has not been lost on regulatory bodies, which have been implementing increasingly strict regulations and shown a willingness to pursue cases against CISOs and, potentially, other members of upper management, even to the point of filing criminal charges, as in the cases of Uber and SolarWinds. 

Adopting an enterprise-wide security culture is essential in today’s environment. And because so much of a company’s value rests in its data, applications and services, secure coding is a core element of that culture. Targeted training and upskilling as part of a cultural mindset, together with proof that training has helped in changing the culture can set organizations on the path to strengthening their security postures. 

There is value in developer-driven security programs. The proof is in the Trust Score.

Security teams struggle to keep up with the tidal wave of new innovations in today’s cloud-driven DevOps world, so it stands to reason that they are equally unable to keep pace with the myriad of ways attackers exploit the weaknesses that inevitably come with so much code constantly being generated. 

Yet despite the accelerating pace of significant security breaches—from the likes of the Equifax data breach and the SolarWinds supply chain attack to more incidents in recent years, such as the successful attacks on Change Healthcare, AT&T and others—many organizations continue to focus on a reactive approach to security. They put most of their security resources into finding and fixing vulnerabilities and responding to incidents as they occur. That approach may have been suitable in another time, but the rapid evolution of software, technology capabilities and IT infrastructure is too much for understaffed and overworked security teams to keep up.

To avoid being continually disadvantaged, they need to stop chasing security threats that move too fast for them or wait until the data-breach horse is out of the barn. Instead, they should get in front of the problem by taking a preventive, rather than reactive, approach. Improving the security of both legacy apps and new applications requires a Secure-by-Design approach—bolstered by effective developer training—to ensure security best practices are employed at the start of the software development lifecycle (SDLC) and that vulnerabilities are remediated before they go into production.

To date, this has proved to be much easier said than done. 

Secure Coders Are in Short Supply

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has been trying to push prevention as a key policy with its Secure-by-Design initiative, which promotes secure coding along with other best practices—ranging from multi-factor authentication (MFA) to reducing classes of vulnerabilities—and encouraging organizations to take the Secure-by-Design Pledge. Other countries, including Australia, Canada, Germany and the U.K., have launched similar programs. Nevertheless, our research shows that precious few organizations have come on board so far.

If we combine all the developers on Secure Code Warrior’s Learning Platform with those of SCW’s competitors working in the Secure-by-Design vein, there are between 500,000 and 1 million developers who are taking this approach. By the most generous estimate, that’s around 3.5% of the total number of developers worldwide, projected to reach 28.7 million by the end of 2024. That’s a lot of developers producing more code than ever before, especially with generative artificial intelligence programs greatly accelerating the pace of development, and very few learning how to start with secure code. 

Software engineers generally are not taught cybersecurity because the traditional model has called for developers and security professionals to work as separate entities, with security teams addressing security issues after software has been created. But security professionals are woefully outnumbered in today’s environment. The most recent Building Security in Maturity Model report, BSIMM14, shows that there are, on average, 3.87 AppSec professionals for every 100 developers globally. Having fewer than four trained specialists trying to secure the output of 100 developers working at breakneck speed isn’t a recipe for secure code. 

The neglect of application security is similarly evident when comparing its market size to other security sectors. The components that make up a Secure-by-Design approach fall into the applications security market, which is expected to grow from $6.08 billion in 2023 to $17.51 billion by 2031. That looks like rapid growth, but it pales when compared with the money spent on network security, projected to increase from $23.57 billion in 2023 to $67.33 billion by 2032, or operational technology security, which is poised to grow from $18.03 billion in 2023 to $57.51 billion by 2031. 

Considering the growing importance of secure code and applications, that area is underfunded. In fact, if companies invest more in application security and a Secure-by-Design approach, they may be able to save in other security areas. 

There are a number of other factors that contribute to the view that preventive security is harder to implement, and therefore harder to sell to top executives. For one thing, companies that have been around a long time, such as those in the financial services sector, are saddled with old legacy systems, some of them dating to the middle of the last century when COBOL was the programming language of choice. 

The idea of bringing preventive security to legacy code and systems at the same time as newer applications can seem daunting, but a Secure-by-Design approach, enforced by upskilling developers, can apply security best practices to those systems. It’s the best chance many organizations have of improving their security postures. 

Building a Culture of Prevention

The transition towards a preventive approach to security may be off to a slow start, but the push for adopting Secure-by-Design practices isn’t going away because the pressing need for it in today’s cyber threat environment isn’t going away either. The automobile industry would be raked across the coals if it decided to invest in more ambulances and EMTs rather than making cars safer, yet many organizations follow that model when it comes to cybersecurity.

Organizations need to adopt a preventive, proactive approach to reducing risk. They should build programs to upskill developers on writing secure code and correcting errors (such as those introduced by AI assistants or third-party code) early in the SDLC. These programs should include agile, interactive training programs that fit developers’ schedules and can be tailored to their work environments and the programming languages they use. Upskilling should involve hands-on training that addresses real-world problems.

Importantly, it needs to include a means to measure their progress to ensure they’ve made security best practices a vital part of their everyday routines. A tool such as SCW’s Trust Score uses benchmarks to gauge progress both internally and against industry standards while also identifying areas that need to be improved. 

A Secure-by-Design approach would be holistic, reflecting a security-first mindset within the organization, where security is a business priority. Response and recovery are essential parts of an organization’s overall security posture, certainly. But by focusing on prevention, enterprises can make great strides in reducing risk and perhaps avoiding the kind of major breaches that can threaten a business’s viability.

Learn more about how Secure Code Warrior can assist you in realizing a viable Secure-by-Design initiative today.

With cyber threats becoming more prevalent and increasingly sophisticated, the focus of cybersecurity is centering on the importance of secure code. The White House’s National Cybersecurity Strategy and the Cybersecurity and Infrastructure Security Agency’s (CISA’s) Secure-by-Design initiative, along with initiatives and legislation in other countries, puts the responsibility for security squarely on the shoulder of software producers. Shifting left—or more accurately, starting left—to ensure security early in the software development lifecycle (SDLC), once considered nice to have, is now essential for organizations to protect their data and systems and avoid regulatory fallout in the wake of a breach.

The key to ensuring secure coding practices is in developer training. Software engineers typically receive little or no cybersecurity education. Their job, especially in today’s accelerated DevOps environment, has been to spin out new applications, upgrades and services as quickly as possible—increasingly with the help of fast-working generative AI models—and let security teams address cybersecurity issues at some point later in the SDLC. That’s an inefficient way to address the plethora of flaws that crop up with so much code being created, often resulting in software vulnerabilities being released into the ecosystem.

Developers need to be trained to write secure code from the start and be able to catch insecure code generated by AI or when it’s present in open-source and other third-party software they use. For many development teams and organizations, this is untrodden territory. How do they know developers are getting the training they need? And is that training being applied on a regular basis?

Some companies pursuing developer education have found it beneficial to establish a baseline set of skills for developers to acquire and measure their progress against clearly defined benchmarks. To help with that effort, Secure Code Warrior has launched a benchmark designed to accurately measure developers' progress in security training. The SCW Trust Score allows organizations to measure how well training is being applied on the job and enable security, developer, and engineering teams to collaborate.

It’s a way to see proof that secure-code training is taking hold while identifying areas for improvement.

The Case for Secure Design

Software producers have every reason to bring security into the SDLC at the beginning of the process. The rising demand for applications and services and the speed that AI brings to the development process has proved useful to developers, who quickly adopted generative AI, but it also inevitably results in buggy software being released into the pipeline. The more code generated, the more flaws—and recent research has found that nearly three-quarters of applications (regardless of how they were created) contain at least one security flaw, with nearly 20% of them considered critical. 

Catching up with vulnerabilities later in the SDLC is becoming prohibitively time-consuming and costly. The National Institute of Standards and Technology (NIST) has found that fixing defects during testing takes 15 times longer than securing software at the start of the SDLC, and fixing them during the deployment/maintenance stage can take 30 to 100 times longer. 

All of this underscores the importance of applying security at the beginning of the development cycle, which has proved to be not only the most effective way to reduce risk, but the most cost-effective. Developers—working with security teams rather than having them function as separate entities—are in the best position to bring security into the start of the SDLC. And developers trained in security best practices have been effective at reducing vulnerabilities. The problem is that so few of them have been trained.

The Beauty of Benchmarks 

The basic path for companies involves establishing a baseline of security skills, providing training, and verifying—to both the organizations and regulators—that developers have acquired the necessary skills. This has proved challenging for many organizations across all economic sectors, but it doesn’t have to be.

One of the challenges security leaders identify is the difficulty of scaling a training program across the entire enterprise. But SCW’s research shows that organizations, especially those with large cadres of developers, can successfully implement a secure-design approach. The results of smaller organizations tend to show a wide variance in how well they apply Secure-by-Design principles. Still, they, too, can benefit from an approach that includes Trust Scores, and will likely show improvements more quickly.

Trust Score uses benchmarking metrics to measure the progress of individual learners, aggregates their scores to assess the performance of the overall team and compares the organization’s progress with industry benchmarks and best practices. It not only tracks training but shows how well developers are applying their new skills on a day-to-day basis. It also highlights areas that need to be improved, enabling the organization to optimize its training/upskilling programs. 

Across CISA’s critical infrastructure sectors for which data was available, most organizations are at about the same level in implementing secure design principles. Trust Scores for sectors ranging from financial services and the defense industrial base to healthcare, IT and critical manufacturing fell in the same range—a little over 300 on a 1,000-point scale. No one industry outpaces the others, despite the conventional wisdom that financial services, as the most regulated industry, would be far in front.

Critical infrastructure sectors not included in the Trust Score ranking—such as chemical, energy, and nuclear operations—generally don’t create their own software, instead relying on other sectors, particularly IT. However, the importance of maintaining secure systems within those sectors (no one wants to see a nuclear power plant get compromised) only shows how essential it is to secure the software they use in the first place.

Conclusion

The increased regulatory pressure and the realities of the cyber threat landscape have made a Secure-by-Design approach imperative for organizations that want to protect their data, systems, business operations and reputations. In large part, creating secure software is in the hands of developers, but they need assistance in the form of a thorough upskilling and training program that provides the education they need, and shows how it’s being applied. 

A program that includes benchmarks, backed by a tool such as Trust Score, can provide a clear view of a development team’s critical progress. It’s a vital new approach that both developers and the companies they work for need to ensure that they are constantly improving their secure software development skills, while also meeting the new Secure-by-Design requirements.

‍

It has been heartening to witness CISA’s Secure-By-Design (SBD) movement gain momentum worldwide, as the United States, Australia, New Zealand, Canada, Singapore, Japan, Germany, and the UK commit to weaving similar guidelines into their broader cybersecurity strategies, and many of these nations also contributing to the original recommendations.

Since April 2024, more than 200 companies, including Secure Code Warrior, have signed the Secure-by-Design pledge, indicating broader industry commitment to higher software quality and security standards. We see these guidelines as a crucible moment for cybersecurity leaders who, for the first time, have global government support for significant cultural change in software development. While these recommendations are not yet mandatory outside of software vendors selling directly to the US government, I see this as not just the future, but a golden opportunity to start fighting back against threat actors. Central to the guidelines is striving toward removing categories of vulnerabilities, and industry-wide focus on this goal could see us making the most significant, positive impact on digital safety in decades.

We believe this movement is critical, and our latest research paper, Benchmarking Security Skills: Streamlining Secure-by-Design in the Enterprise is the result of deep analysis of real Secure-by-Design initiatives at the enterprise level, and deriving best practice approaches based on data-driven findings. 

Measuring ROI of Organizational Secure-by-Design Efforts

An overhaul of long-established software development practices is no small undertaking. CISOs are often challenged when attempting to prove the return on investment (ROI) and business value of security program activities at both the people and company levels, with many expressing growing frustration at budget reduction and a lack of top executive buy-in to new cyber initiatives. However, a data-backed proposal will make all the difference here. 

In recent years, the absence of a skills benchmark to enable organizations to evaluate how they’re tracking against industry standards has been a key challenge. This has made it incredibly difficult to devise and implement security programs that impact the right areas and foster continuous improvement of the development cohort, a crucial element of successful software security practices. 

The key to making Secure-by-Design initiatives work is not only giving developers the skills to ensure secure code but also assuring the regulators that those skills are in place. So, we decided to analyze developer team readiness, and the results may surprise.

How Companies Trying to Accelerate Their SBD Initiatives Can Take Advantage of Trust Score

It’s virtually impossible to improve efficiently without a solid idea of where you’re starting and where you need to go. However, hundreds of enterprise customers effectively utilize SCW Trust Score—a global benchmark that quantifies developer teams’ security competencies—to provide these helpful, granular data points. These insights shape highly effective, developer-driven security programs that are conducive to successful Secure-by-Design initiatives.

The analysis revealed in our white paper shows that organizations across the top critical infrastructure industries are progressing in preparing their developers to advance their SBD initiatives. We also found that these industries’ developer teams possess an average security posture.

Secure Code Warrior’s analysis of developer upskilling across critical infrastructure industries is based on insights from over 20 million data points, across 600 enterprise customers and more than 250,000 active developers around the world. The analysis found that:

• The total number of developers currently involved in developer-centric SBD upskilling initiatives is less than 4% of all developers globally;
• The financial services industry possessed the highest Trust Score of 336;
• Most large-scale Secure-by-Design upskilling initiatives are successful, while smaller-scale initiatives tend to be scattered. However, when given a mandate, they have been shown to deliver a measurable return on investment (ROI) sooner;
• When upskilling initiatives are firmly in place, risks introduced by developers in applications are considerably fewer. The analysis found that developers within large upskilling initiatives (7000 developers+ in a single company) can predictably reduce vulnerabilities by 47-53%.

The Solution | Conclusion

SCW Trust Score is a powerful tool in any security leader’s arsenal, allowing a comprehensive drill-down to specific areas within an organization. Reports can be filtered according to languages, teams, or categories, producing customized reports that allow companies to address the specific needs of developers or teams and identify the areas where additional training or coaching is needed. After all, security is a never-ending endeavor; effectively benchmarking performance will help identify opportunities for continuous improvement.

Accelerated software development and deployment, coupled with an ever-more-menacing cyber threat landscape and increasingly hawk-eyed regulators, have put cybersecurity on the front burner. Organizations, if they haven’t already, must prioritize developing an enterprise-wide security-first culture.

Linux users haven’t had an easy time lately, with several high-severity vulnerabilities reportedly affecting the system in various ways over the past few years. Security researchers now have another cluster of vulnerabilities to unpack, all relating to the Common UNIX Printing System (CUPS) function targeting GNU/Linux systems with a potential pathway for potent Remote Code Execution (RCE).

On September 27, 2024, evilsocket.net’s Simone Margaritelli published critical information about several exploitable vulnerabilities in CUPS, with CVEs subsequently assigned to four of them. This number could grow, but at the time of writing, the security community is debating the actual severity of these discoveries. While one of the CVEs, CVE-2024-47177, has a current critical severity rating of 9.1 from MITRE, successful manipulation of this command injection flaw is reliant on servers with the CUPS service enabled and, additionally, requires access to UDP port 631 or DNS-SD. RedHat notes, however, that it is possible to remap CUPS to a different port. 

Margaritelli’s comprehensive breakdown of the incident reveals an insidious, complex chain of attacks that, despite community disagreements, should not be ignored. It affords us a lesson on seemingly innocuous dependencies being deeply exploitable if a threat actor is determined enough and if small windows of opportunity have been left open by poor coding patterns.

The CUPS scenario is a little different from what many developers and AppSec professionals may have previously experienced, so let’s take a look and test your skills along the way.

The vulnerability: Remote Code Execution (RCE) Via CUPS

The Evilsocket blog provides an unmatched, thorough background to these exploits, and this is a resource we will continue to follow closely. Margaritelli also quotes an unnamed source in his article, who does not appear optimistic about the general security robustness of Linux:

‍

“From a generic security point of view, a whole Linux system as it is nowadays is just an endless and hopeless mess of security holes waiting to be exploited.”

This is a sobering reminder of the inherent security risks that remain prevalent in open-source environments, not to mention the dire need for heightened security awareness and secure coding skills among the global development community.

Let’s take a look at the CVEs:

• CVE-2024-47177
• CVE-2024-47176
• CVE-2024-47076
• CVE-2024-47175

‍The vulnerability chain is widespread, and currently impacts all current and previous versions of the following packages:

• distrotech/cups-filters
• OpenPrinting/cups-filters
• Cups-browsed
• libcupsfilters
• libppd
  
  

CUPS has been a legacy component of UNIX and Linux operating systems for over two decades. Its function as a print services dependency makes it eager to perform network requests, rendering it a prime target for RCE-class vulnerabilities.

In this instance, however, there is some ingenuity in how the attacks combine to provide a successful outcome. This is essentially the ability of an unauthenticated, undetected attacker to replace Internet Printing Protocol (IPP) URLs with malicious ones, in addition to modifying directives that can cause command injection in the "PPD (PostScript Printer Description) file, which is a file used to describe the features of the newly added printer. This results in a command execution attack once a print job is activated, and relies on a lack of input validation within the CUPS components.

Further, fixing this particular vulnerability creates something of a double-edged sword, as Evilsocket points out. CUPS includes the foomatic-rip filter, an executable with prior history of being a high-risk, exploitable component. CVEs relating to this component date back to 2011, and while it has been established that foomatic-rip can be leveraged to execute OS commands, fixing this causes stability issues and loss of support for many older printers. It is a complex problem to overcome.

1. Threat actor initiates the attack
   1. CVE-2024-47176: cups-browsed <= 2.0.1 is vulnerable because it binds to UDP port 631 using INADDR_ANY, which means it trusts any packet received from any source. This allows an unauthenticated remote attacker to send a malicious UDP packet with a manipulated IPP URL (pointing to the attacker-controlled IPP server), triggering the vulnerability. The victim’s machine now thinks it’s connecting to a new printer and sends a request asking for printer attributes.
2. Victim system processes the printer attributes
   1. CVE-2024-47076: libcupsfilters <= 2.1b1 has a vulnerability in cfGetPrinterAttributes5, which does not properly validate or sanitize the IPP attributes returned from an IPP server. When cups-browsed processes the packet, it can be tricked into reading malicious attributes sent by the attacker.
3. Victim system connects to the attacker-controller IPP server
   1. CVE-2024-47175: libppd <= 2.1b1 in the ppdCreatePPDFromIPP2 function does not properly validate or sanitize IPP attributes when saving them to a temporary PPD (PostScript Printer Description) file. This allows the attacker to inject arbitrary data into a PPD file, including the FoomaticRIPCommandLine directive, which the printing system can later execute.
4. Victim system initiates print job and attacker’s code is executed
   CVE-2024-47177: cups-filters <= 2.0.1 is vulnerable because the foomatic-rip filter executes arbitrary commands through the FoomaticRIPCommandLine directive, allowing the attacker to run commands as the cups-browsed process. The attacker waits for the victim’s machine to initiate a print job. The moment this happens, the attacker’s malicious code will be executed (Remote Code Execution).

How can you mitigate RCE risk?

For companies utilizing CUPS as part of their business operations, they must follow the recommended remediation advice from Evilsocket and RedHat. This includes, but is not limited to, applying security patches as an emergency-level priority.

For Command Injection in general, check out our comprehensive guide.

If you’re interested in getting more free coding guidelines, check out Secure Code Coach to help you stay on top of secure coding best practices.

Actionable insights that measure your secure code learning efforts 

Maximizing the value of your secure code learning program relies heavily on your users’ engagement. The world of cybersecurity is a constantly evolving landscape with new threats as well as opportunities to strengthen your overall security posture. Taking a proactive approach to your code’s security requires ongoing secure code learning to maximize the efficacy and relevance of the program. To do that, program leaders need to have a clear understanding of user engagement not just at a single point in time, but over extended periods to identify trends and optimize the program's performance.

That’s why we are excited to announce a new report designed to measure your users’ engagement that makes it easy to spot key trends and identify when to take action within your organization. With these new insights organizations can not only do more to maximize their return on investment in secure code learning but also make lasting improvements to their cybersecurity posture.

What’s New In This Report?

The Engagement Insights report presents a number of key statistics relevant to your agile learning program, over your selected time period (by default, the past 12 months), all of which is also accessible via the Reporting API. The Engagement Report provides a quick and easy view into the number of New learners who have been actively engaged with the SCW agile learning platform during this time period, Active learners who engaged with the platform, and current number of Enabled learners.

‍

‍

These totals are only the start. You can break down how your learners have been engaging with the platform, discoverings trends of Active learners over the time period selected. With this information you can plan communications (internal newsletters, blogs) or other engagement activities to keep developers coming back to hone their skills.

‍

Similarly, the Last learning activity breakdown shows how recently your learners have last engaged with the SCW platform. Like any form of learning, recollection of concepts fade over time. The ideal state is to have the bulk of your learners grouped in the first couple of brackets denoting recent engagement. This sort of grouping not only keeps developers’ skills fresh, and improves your organization’s SCW Trust Score by avoiding time bound skill fade in the aggregate.

‍

‍

And the insights go beyond frequency and recency. You can dive deep into how users are engaging in secure code learning activities.The Engagement Report delivers a breakdown of the amount of time learners have spent across the different parts of the Secure Code Warrior platform throughout the time period selected. Admins can use this information to identify what drives engagement amongst the user base. Has it been a while since you last ran an SCW tournament, could there be an opportunity to re-engage a portion of your developer cohort? Are learners using the Explore module to broaden their horizons outside of the structured learning content in Courses or Assessments? Identifying high engagement types as well as top level users offers opportunities to design programs developers will love and celebrate your active leaders.

‍

As you can see, there are many ways to measure your learners’ engagement with your agile learning program. We remain dedicated to providing further insights and reports to drive the most effective learning outcomes and improvements in your organization’s cybersecurity posture. Stay tuned for the next new insights to come, and please let us know if you have questions, feedback, or specific data you’d like to see more of to help optimize your program!

‍

Reducing security debt is something that all companies strive to achieve.  How does one minimize the amount of security vulnerabilities?  How does one speed up time to market while ensuring that the code being generated is top notch?  

Like many companies, DigitalOcean chose Secure Code Warrior to drive digital innovation and modernization by building and releasing quality code from the start with security-aware developers.  

DigitalOcean, which offers scalable computing resources and a suite of cloud solutions that enable developers to deploy, manage, and scale applications effortlessly, turned to Secure Code Warrior as the company expanded and grew its engineering teams.  In the fast-paced technology industry, the company needed to ensure their developers could identify common poor coding patterns that arose in design reviews so that they could proactively prevent them from recurring. 

As Ari Kalfus, senior manager of product security noted, “We needed a solution that was developer-specific, hands-on, and focused on the risks that our organization was facing.”  Secure Code Warrior delivered on this, with one of the most notable outcomes being the ability to quickly and regularly reinforce secure coding practices.  This led to a marked decrease in security debt across teams. Overall, DigitalOcean has found that teams trained with SCW were not only more adept at identifying and mitigating security issues, but they also now have the confidence to push the boundaries of innovation without compromising security.

Read more here about how DigitalOcean reduced its overall security debt… and is now using its security surplus to further push the boundaries of productivity and innovation.

Secure-by-Design is the latest initiative on everyone’s lips, and the Australian government, collaborating with CISA at the highest levels of global governance, is guiding a higher standard of software quality and security from vendors.

A significant uptick in software security will require a groundswell of support for security skill-building and, when it comes to developers, an emphasis on continuous learning around secure coding best practices. It is refreshing to witness a new chapter for the industry, in which global governments are leading by example and providing appropriate guidance to mitigate insidious, code-level vulnerabilities.

The Australian Women in Security Network (AWSN) has worked tirelessly to promote more women in cybersecurity roles in Australia. We, along with Commonwealth Bank (CBA), recently held a secure coding tournament for security-savvy developers and professionals to showcase their skills in a friendly, competitive environment.

This July 17 event was well-attended by incredible women representing multiple verticals, and it’s safe to say that their contributions will assist in shaping Australia as one of the most cyber-safe nations in the world by 2030.

Endorsement for a more secure future

We were fortunate to have Lt. Gen. Michelle McGuiness, Australia’s Cyber Security Coordinator, supporting the joint AWSN/CBA/SCW tournament event. Speaking directly to Australia’s Six Cyber Shields initiatives and endorsing Secure-by-Design principles, her words resonated with the room of dedicated cyber professionals committed to positive changes and higher standards of software design and execution:

‍

‍

“We want to enlist the whole country in tackling [cybersecurity] challenges, and that includes making sure we build a strong and diverse and, of course, inclusive, welcoming cyber workforce.

Our strategy is built around six cyber shields that help protect our businesses, our organizations, and our citizens. Perhaps most pertinent to today's event is our work under the strategy that focuses on secure by design and secure by default. We should have every confidence that we won't be exposed to unnecessary risks when we buy digital devices or software.

And, of course, industry has a great role to play in helping us foster, grow and support these pathways for the benefit of their company, the benefit of our economy … and the security of our nation … I commend Secure Code Warrior and CBA as well as … AWSN for their leadership in bringing together today's event.”

What happens when you code like a girl?

Something incredible has always stood out to me whenever we have large-scale tournament events like this one. Typically, they involve tens of thousands of developers, and as is the statistical case industry-wide, quite a small percentage of the participants are female.

However, a female participant often ends up on the winners’ podium and shares the prize pool. I believe this speaks volumes for the inclusion of women in traditionally male-dominated spaces. Not only do they belong, but they can excel and be an aspirational force within their teams.

The competition was fierce in this event, and our overall winners, Bella Howard and Shanelle Haire, clearly have a bright future at the forefront of developer-driven security practices. They said of their win:

“We are thrilled about the win! Working as a pair was instrumental to our success—we believe our diverse skills and experiences complemented each other perfectly.

We also want to acknowledge that everyone performed exceptionally well. We are truly honored to have won and thoroughly enjoyed the event. We look forward to seeing you at the next one!”

Let’s get to know them a little better:

‍

• How long have you been working on your secure coding skills?

We both pursued dual degrees in IT, where our secure coding skills began to take shape. Bella developed a keen interest in cybersecurity, and we both attended events and workshops to expand our knowledge of the security field.

Through our employment, we have had the opportunity to utilize Secure Code Warrior, which has been instrumental in our development. Bella's focus on secure coding practices enhances her knowledge as a Security Analyst, while Shanelle's role as a Software Engineer demands a secure mindset, making secure coding an essential part of her responsibilities.

• Do you have any tips for women in STEM who are starting their secure coding careers?

We can highly recommend participating in security communities and learning from those already in the field. Joining female-led communities is also a fantastic way to gain support from women who have been in your shoes and can offer valuable guidance and encouragement.

Attend events like the Secure Coding Tournament and other industry-related workshops to learn and network while having fun. Seek out mentors who can guide you through your career and provide valuable insights. Don't wait until you feel like you know everything before you start—hands-on experience is the best way to learn.

• What is one thing you would do to promote the importance of cybersecurity best practices?

It's crucial to emphasize that security is everyone's responsibility. For effective in-depth security, all individuals working across the technology stack, as well as all users of technology, need to be aware of and adhere to security best practices. By fostering a culture where security is seen as a collective responsibility, we can better protect our systems and data.‍

‍

We thank all participants and look forward to partnering with AWSN on future projects.

‍

Organizations understand that secure by design principles are only successfully implemented through developer driven security. After all, developers are the ones designing, building, and ultimately committing the code that powers an organization's software. Ensuring that these invaluable contributors have the knowledge and skills to implement secure code best practices is absolutely critical.  However, the challenge of implementing this often comes down to aligning developer secure code knowledge and skills with the programming languages they use when building software.

This challenge is further complicated by the sheer volume and mix of programming languages that are being used in an organization’s codebase, often completely unbeknownst to security teams. So how do CISOs, AppSec and Engineering leaders ensure that the code that is being produced and committed is backed by a developer’s secure code knowledge and skills in that commit’s specific programming language?
‍

Introducing SCW Trust Agent

Secure Code Warrior has launched SCW Trust Agent to answer this difficult question. SCW Trust Agent gives security leaders the visibility and control needed to scale developer driven security, empowering developers and teams to deliver code faster while maintaining and improving the security of what is committed.
‍

How Does SCW Trust Agent Work?

SCW Trust Agent connects to your code repository to assess the metadata of every code commit. It inspects the developer that made the commit, the programming languages in use, and the exact timestamp when the code was shipped. It then pairs this analysis alongside data and insights from SCW’s agile learning platform to determine if the developer has sufficient security knowledge in that specific programming language. Based on this information, it returns a rating on the health of that commit in accordance with your policy configuration. These policies are customizable and configurable by Admin users, who can set specific guidelines and requirements for commits that can have a higher or lower threshold of requirements based on that project or repository’s overall sensitivity.  
‍

Strengthening Your Security Posture

Having this visibility and customizable control not only gives an organization insight into overall commit health across all of its repositories, but also the tools it needs to strengthen its security posture, mitigating risk by taking a proactive approach. SCW Trust Agent looks to ensure that developers are knowledgeable and skilled in the security implications of the specific coding language they are using when going to make a commit. This assurance reduces the likelihood of inadvertently introducing a vulnerability into the code that could be exploited.
‍

Optimizing The Development Lifecycle

This proactive approach not only improves an organization’s overall security posture, but also can also drive new optimizations in the development lifecycle. By ensuring developers have secure code knowledge and skills in the language of their commit,  the number of introduced vulnerabilities that would later need to be identified and remediated are reduced. Remediation and rework tend to be large time drain for developers, often interrupting their workflow and impacting their velocity.  Reducing vulnerabilities through a proactive approach minimizes these remediation cycles keeping development teams focused on delivery of high value code and capabilities.
‍

Scaling Developer Driven Security

SCW Trust Agent gives organizations the tools they need to scale their developer driven security programs. CISOs and Appsec teams have the visibility and control they need to apply proper governance, meet and even exceed compliance standards with detailed insights into policy design, application and adherence. And developers are empowered to deliver secure code faster with secure code training that is specific to the languages they utilize in the code that they deliver.

SCW Trust Agent works with any Git-based source code management tool and connecting your code repository is easy with multiple connectivity options including on-premises, cloud based, and manual upload. To learn more visit www.scwtrustagent.com or contact us, we’d love to discuss how we can help your organization strengthen its security posture and scaling developer driven security.

‍