Top 5 Ways to Get Developer Application Security Buy-In [VIDEO]

The speed and scope of software development today is creating new challenges in ensuring the security of software. But they also create the opportunity to finally get application security right. Both the challenge and the opportunity stem, in part, from the fact that security is “shifting left.” The responsibility for ensuring the stability and security of software through production and customer usage is moving earlier in the cycle to include developers. This shift means security can get baked into code earlier, greatly increasing the chance of producing secure code without costly late-stage fixes.

But it also means a higher level of developer involvement in security, and often some work by the security team to get developers on board with the initiative. To ensure the success of your application security initiative, it’s essential to work closely with your developers so they understand the guidelines, strategies, policies, procedures and security risks involved with application security. What’s more, they must be prepared and equipped to operate securely within their particular development processes. Ryan O’Boyle, product security architect at CA Veracode, recently recorded a quick “chalkboard” video where he outlines our top 5 ways to get developer application security buy-in. Listen to Ryan as he walks you through:

Way No. 1: Timing: Bring in developers early in the planning process.

Way No. 2: Understanding: Learn about developers’ priorities and processes.

Way No. 3: Training: Most developers have no training on secure coding practices.

Way No. 4: Integrating: Work to integrate application security into existing developer tools and processes.

Way No. 5: Automating: Build tests into the pipeline through automation.

Watch Ryan’s short video get all the details on these five tactics, and set yourself up for AppSec success.

The post Top 5 Ways to Get Developer Application Security Buy-In [VIDEO] appeared first on Security Boulevard.

from Top 5 Ways to Get Developer Application Security Buy-In [VIDEO]

Security: Here’s What You Need to Know About Development

The days of security and development working in separate and isolated silos are over. Security is now a task shared by the development and security teams throughout the software lifecycle – from inception to production. Security testing has become primarily the responsibility of developers, with security taking on more of an enabling role – crafting and communicating policies, assisting with remediation and mitigation guidance, and implementing developer training. This is a big change for most security teams, and requires not only a mindshift about roles and responsibilities, but also about the level of understanding and knowledge. It’s no longer feasible for security professionals to have a superficial understanding of how developers work; they need a deeper understanding of development processes, tools and priorities. Where to start? Increase your developer knowledge by getting a handle on the following:

Development priorities and challenges

Do you know what your developers are goaled on? Do you understand their processes and what slows them down?

It’s no longer practical to make extensive security demands of development teams without any awareness of their workload and priorities. Security and development need to work together, which means understanding each other’s pain. Since developers can’t fix every flaw at the same time, security needs to be pragmatic, be aware of development’s priorities and bandwidth, and help them prioritize the tasks and the timelines.

Having empathy for developers and their challenges will go a long way in making you more effective. Try taking a developer or two to lunch, and have them explain their processes and challenges. Another option: Shadow a developer for a day or part of one to understand their challenges and processes.

Further, check out online developer community like StackOverflow or developer.com. Find out what developers are thinking and talking about. Look for security-related topics and questions, and contribute to the conversation where you can.

Development tools and technologies

Do you understand container technologies, build systems, or configuration management tools?

Ultimately, you should have a firm grasp on how developers are producing code, checking code into source control, spinning up environments and deploying code to the pipeline. You need this understanding to optimize how security testing is integrated into these processes.

Focus on gaining a high-level understanding of the tools and what they do, rather than details about specific tools.

DevOps

Do you understand how DevOps is different from Agile or waterfall? Do you understand the benefits and goals of this model?

You definitely need a clear understanding of this development model. Even if your organization hasn’t fully embraced DevOps, this is the future of software development.

Good places to start: The DevOps Handbook and The Phoenix Project by Gene Kim

Open source component use

How are your developers using open source components? Where are they finding them?

Understanding how code comes into your organization will be increasingly critical. Today, it is very easy for developers to inadvertently pull vulnerable code into your organization. In turn, the security team should put governance in place regarding open source component use.

Coding basics

Could you do some simple coding? Do you know what languages your developers are coding in?

You will need to be familiar with coding practices in order to understand how security fits into them. There are numerous free or almost-free software development classes available. Try Coursera of Ed-X, or consider augmenting a CISSP with a CSSLP.

Your developers’ secure coding knowledge

Does your development team know how to avoid introducing security vulnerabilities into code? Are they familiar with the major security vulnerabilities?

Most developers have not had training on secure coding, either in college or on the job. Find out which training would work best for them – eLearning, instructor-led training, training modules within their current systems? In addition, which flaws are you seeing most often in code? Customize the training based on the specifics of what your team needs to work on.

Where to find out more

We’ve created a toolkit of resources to help the security team boost their development know-how. Download Understanding the Dev in DevSecOps: A Toolkit for the Security Team to get a valuable bundle of assets on everything from the basics of DevOps and CI/CD to open source component use and best practices for securing DevOps.

The post Security: Here’s What You Need to Know About Development appeared first on Security Boulevard.

from Security: Here’s What You Need to Know About Development

Podcast: 2017 AppSec Lessons Learned

“The more things change the more they stay the same” could be the application security motto for 2017. Last year featured breaches stemming from the same vulnerabilities that have been wreaking havoc for years. In fact, we saw SQL injection in about 30 percent of the apps we scanned in 2017 – a number that hasn’t budged much since 2011.

2017 also shone a harsh spotlight on the risk of open source component use, with several high-profile breaches originating with this type of code.

But 2017 also brought some reasons to be optimistic about the future of application security. We’ve seen awareness increasing, best practices emerging and many organizations moving the needle in reducing their application layer risk.

CA Veracode’s Director of Content and Corporate Communications Jessica Lavery recently sat down with Evan Schuman to take a look back at AppSec in 2017 and discuss where it’s headed in 2018.

The post Podcast: 2017 AppSec Lessons Learned appeared first on Security Boulevard.

from Podcast: 2017 AppSec Lessons Learned

Did You Read Our 5 Most Popular 2017 Blog Posts?

2017 was quite a year for application security. From big breaches to breakthroughs, 2017 featured a lot of scary headlines reflecting the sorry state of application security, but also news about companies moving the needle on AppSec, and regulators waking up to the reality about how data is exposed.

Not surprisingly, our most popular 2017 blog posts mirror the trends and headlines – and reveal both that organizations are concerned about and paying attention to breaches, and searching for ways to become more secure.

Our Most Popular Blog Posts in 2017:

2017 featured some very big, headline-grabbing breaches. WannaCry and Struts-Shock were two of the biggest:

1. WannaCry Ransomware Attack Is a Symptom of a Much Bigger Problem

2. Don’t Get Zapped by the Struts-Shock Vulnerability Affecting Apache Struts 2 Struts-Shock

Cybersecurity regulations were a big topic in 2017, especially EU GDPR and NY DFS:

3. FAQs About the New York DFS Cybersecurity Regulation

The “shift left” message is finally getting traction. As organizations realize that the key to secure code is starting with developers, our Greenlight product got a lot of attention this year:

4. Never Leave Your IDE Again: Secure Coding Feedback in Seconds

Finally, this highly practical series of posts on cryptography by our Principal Security Researcher Mansi Sheth was very popular in 2017 – a sure sign that organizations are searching for ways to do security right:

5. How to Get Started Using Java Cryptography Securely

Cryptographically Secure Pseudo-Random Number Generator (CSPRNG)

Encryption and Decryption in Java Cryptography

Did you miss any of these posts last year? Don’t miss a thing in 2018; subscribe to our blog. 

The post Did You Read Our 5 Most Popular 2017 Blog Posts? appeared first on Security Boulevard.

from Did You Read Our 5 Most Popular 2017 Blog Posts?

Overcoming the Language Barrier Key to DevSecOps Success

As DevOps moves to DevSecOps, there is a significant “people” component involved in the shift. Development and security teams both need to overcome their “language barriers” and understand each other’s processes and priorities. The effort is worth it because we know that (1) the consequences of neglecting software security are getting more damaging and (2) embedding security early and often into dev processes gets results. In fact, our 2017 analysis of the applications we scanned this year revealed that DevOps organizations that tested frequently with sandbox scanning (developer-initiated scans early in the dev process) had a 48 percent better fix rate than those doing policy-only scanning (security-initiated scans late in the dev process). In addition, in a May 2017 report, Best Practices: Strategies for Making the Crucial Shift to DevSecOps, Forrester Research notes that “Recent research on high-performing DevOps teams shows they're spending 50% less time in remediating security issues because security teams are continually working within their DevOps teams to build security into their daily work.”

But getting these two teams to understand each other’s “language” is no easy feat. In the same report, Forrester Research explains, “Security has its own array of terminology and acronyms that are foreign to developers, I&O pros, and line-of-business managers. And each of those disciplines speaks its own language that's equally foreign to the security team. As a result, when these teams try to communicate, it's often unproductive, frustrating, and contentious. This language issue sustains isolation with little hope for resolution.” Here are a few tips to start breaking down these barriers and speaking the same language:

Dev: Understand security

As our Director of Developer Engagement, Pete Chestna, recently noted, “Finding a developer trained in cybersecurity is like finding a needle in a haystack.” Overcome this impossible task with the creation of “security champions” on the dev team. Development managers should identify members of their team who are not necessarily trained in security, but show an interest in the subject. Again, Pete Chestna recommends to identify these champions with questions like, “Do they like to hack or reverse engineer devices, code, and systems? Have they ever participated in a bug bounty program or found a vulnerability? Do they follow security news and thought leaders? Do they participate in hacker culture, watching shows like ‘Mr. Robot’ and attending hackathons?”

Then what do you do with these people? Make them security champions who reduce culture conflict between development and security, help other developers by performing code reviews, and act as the security conscience of the team. They hold feet to the fire to make security a priority during planning and pre-production.

Watch this video to learn more about security champions.

Security: Understand dev

In a DevSecOps environment, developers own the testing of applications in their development environment, fixing flaws to pass policy and continuing to build code. Security, on the other hand, owns setting policies, tracking KPIs and providing security coaching to developers. In addition, security is responsible for providing developers with support in integrating scalable AppSec tools into their SDLC.

In turn, the security function cannot be effective in a DevSecOps world without a thorough grasp of how developers work, the tools they use, the challenges they face and how security fits into this picture.

Bump up your development knowledge by:

Understanding the developer role: Try taking a developer or two to lunch, and have them explain their processes and challenges.

Learning to code: There are numerous free or almost-free software development classes available, such as Coursera and Ed-X.

Experiencing a “day in the life of a developer”: Shadow a developer for a day or part of one to understand their challenges and processes.

Learning about the tools of the trade and how they work – Git, Ansible, etc.: Focus on gaining a high-level understanding of the tools and what they do, rather than details about specific tools, i.e., focus on the “why” not the “what.”

Visiting online developer communities such as StackOverflow or joining development Slack channels: Find out what developers are thinking and talking about. Take it one step further by looking for security-related topics and questions, and contribute to the conversation where you can.

Get more tips and advice on security’s changing role in our new guide, The Security Professional’s Role in a DevSecOps World.

The human side of DevSecOps

In the end, this move to DevSecOps is just as much about people as it is about technology. Learn more about all the factors involved in this changing landscape in Forrester’s Best Practices: Strategies For Making The Crucial Shift To DevSecOps.

The post Overcoming the Language Barrier Key to DevSecOps Success appeared first on Security Boulevard.

from Overcoming the Language Barrier Key to DevSecOps Success