devopsy.kinsta.cloud

Tag: Secure Code Warrior

  • Secure Code Warrior Defines Security Rules for AI Coding

    Secure Code Warrior Defines Security Rules for AI Coding

    Secure Code Warrior has made available a set of security rules for application developers using artificial intelligence (AI) tools to generate code.

    Company CTO Matias Madou said the AI Security Rules made available on GitHub are intended to encourage developers to review code generated by AI for security issues that these tools may inadvertently introduce. Most AI tools were trained using samples of code that were randomly collected from across the web. As such, they can introduce vulnerabilities simply because they were trained using code that contains similar flaws, noted Madou.

    Additionally, the AI Security Rules encourage developers to establish guardrails that steer AI away from risky patterns and common security missteps, such as insecure authentication flows or failure to use parameterized queries.

    Previously, Secure Code Warrior has made available AI security training courses for application developers that Madou said will continue to be expanded.

    In general, AI coding tools have, from a cybersecurity perspective, plusses and minuses. AI coding tools are, for example, unlikely to introduce a SQL Injection vulnerability. In fact, there may come a day when this particular vulnerability is completely eliminated as AI coding tools become more widely used, noted Madou. However, AI coding tools also introduce other potential security concerns, including hallucinations.

    It’s not clear to what degree developers are relying on AI tools to generate code, but a recent Futurum Group survey finds that 41% of respondents expect generative AI tools and platforms will be used to generate, review and test code.

    Additionally, The Futurum Group finds organizations are exploring multiple paths to employing artificial intelligence (AI) capabilities across the software development lifecycle (SDLC). Over the next 12 to 18 months organizations plan to increase spending on not only AI code generation (83%) and agentic AI technologies (76%), but also existing familiar tools that have been augmented with AI.

    In effect, there is now a battle underway between incumbent providers of tools and startup rivals for the hearts and minds of software engineers.

    Regardless of how code is written, an application developer remains accountable for its quality. The challenge is that over time there is often a tendency to trust the output of an AI coding tool too much. Inevitably, the code generated might not only contain vulnerabilities but might also be deeply flawed in ways that might prevent an application from running at all. Just as challenging, AI coding tools might not be of much help when updating existing application environments simply because they might not have enough context to generate code that will work, noted Madou.

    On the other hand, there are many developers that only have a rudimentary appreciation for security issues. AI coding tools in those instances can significantly improve the quality of the code that might otherwise have been created by an application developer.

    There is, of course, no going back. AI coding tools are here to stay. The real issue is putting the guardrails in place that minimize any security vulnerabilities or other types of flaws that might compromise the security of an application.

  • Competing Priorities Prevent Devs From Creating Secure Code

    Competing Priorities Prevent Devs From Creating Secure Code

    The recently released Secure Code Warrior State of Developer-Driven Security Survey revealed that developers continue to wrestle with secure coding practices in a working environment that has long prioritized features and functionality and speed at the expense of security. 

    Of the more than 1,200 developers who took part in the survey, only 14% named security as their top priority. Security was seen as a bottleneck—an astonishing 67% of these developers said they routinely left known vulnerabilities and exploits in their code and 48% shipped products with known vulnerabilities.

    These statistics raise eyebrows, sure, but they are also unsurprising. In the survey, application security fell behind creating quality code, application performance and the ability to solve real-world problems on the list of developers’ priorities.

    In many cases, these results showed that security is either ignored in favor of meeting demanding timelines, developers would rather improve an application’s performance or they simply lack the required training to fix security problems. Regardless of the reason, it is a continuing problem.

    The Need to Balance Security in Development

    As the survey showed, developers often worked with secure code in silos. Security controls were limited to a single category instead of a holistic view of fundamentals. In many cases, developers relied on existing or pre-approved code rather than writing new code free from vulnerabilities. This assumed that the code inserted meets proper security needs, but that assumption often fell short.

    That said, developers who write code often find themselves inadvertently introducing vulnerabilities. This is not entirely the fault of those developers, but some of the blame lies with the cultural risk acceptance of the organization.

    The software organizations themselves must put more onus on secure development. As we saw from the SolarWinds attack, deficiencies in code can lead to massive disruptions. While not all application vulnerabilities have the reach of SolarWinds, businesses often allow for too much risk to pass in their code; that gets passed on to customers and developers are made the scapegoats.

    Provide Developers With the Right Skills

    Security leaders must first ensure developers have the requisite skills to code securely and to make improvements. That includes not just writing the code but also how code is committed through the entire development process. Developers often need hands-on training in proper coding patterns created in the languages and frameworks they commonly use.

    Organizations can no longer overlook security and ship potentially exploitable software. Security must be added earlier in the development process and be seen as imperative to success. The survey showed that many developers believe secure coding is out of their realm of expertise. A staggering 86% said they found it challenging to practice secure coding, while 92% of developer managers said their teams needed more training in security frameworks.

    This highlighted that developers do not get the right kind of training—nor are they get enough exposure to security best practices. It also underscores that designing for security is not seen as an essential skill for developers to have.

    Reasons for Optimism

    While our survey highlighted a disturbing trend, it also offered reasons for hope. The survey showed that attitudes have changed, and 66% of developers expected security to become a more significant priority over the next 12 to 18 months. Hiring managers echoed this sentiment—82% expressed an interest in hiring developers who are knowledgeable in security over those who are not.

    Businesses today have put themselves and their customers in a risky situation; organizational leaders must be agents of change to mitigate this risk. They need to apply a security-first mindset and empower their developers to better integrate security into the development process. Timelines must be revised to allow this to happen. If it continues, the current state of application security will only lead to more (and more severe) breaches. Now is the time to ensure DevOps teams and developers have better access to security training and more time to put those practices into action to ensure long term success. 

  • Improving Software Security in 2022

    Improving Software Security in 2022

    The recent Log4j vulnerability showed just how quickly a security bug could disrupt not just an industry, but the entire world.

    Organizations, especially federal agencies, will always find themselves at some level of risk, but they can also do more to mitigate those challenges. In November 2021, the Biden administration issued a directive through the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) to fix hundreds of software and hardware vulnerabilities. 

    While this effort created an immediate call-to-action to patch known security risks, organizations from all industries must constantly manage known and unknown threats. A study released in July 2021 found it took organizations an average of 205 days to fix critical vulnerabilities, a timeframe that provided bad actors a wealth of opportunity to conduct serious damage.

    Agencies must adopt a more proactive approach to cybersecurity by improving software code quality. Let’s look at how to do that.

    An Ounce of Prevention

    Shaking up the status quo does tend to raise a few eyebrows, but the truth is that security programs should be in a constant state of continuous improvement. Today, our security programs work in an overly reactive state that relies too heavily on mitigation once a threat has emerged.

    Emphasizing a preventative approach may not be widely understood outside the security team, especially when an agency has a relatively clean security record. It might be seen as something that isn’t broken and, therefore, doesn’t need fixing. In this instance, getting leadership buy-in at all levels of an agency is important.

    Some pertinent points security executives should emphasize to change security culture inside their organization include:

    • The time and cost savings achieved through preventative measures, such as role-based training and related tools, as opposed to the potential cost of a critical incident.
    • Finding and fixing software vulnerabilities as code is written keeps releases on time with fewer showstoppers from the security team.
    • Preparing for and preempting potential security risks from the development team to release saves time and money overall. 

    Shifting Left of Left

    Shifting left has been popular in Agile and DevOps environments for over a decade. It involves testing small software components as early as possible rather than waiting until the end of the sprint.

    To create more secure code, organizations need to start left of left, eliminating common vulnerabilities as early as possible to create a safer user experience. 

    Starting left of left is a developer-first concept and requires organizations to get serious about uplifting their engineering cohort, placing emphasis on the creation of high-quality code. Security-aware developers are worth their weight in gold, and they need support in the form of job-relevant, hands-on training in secure code as well as the ability to provision the right tools. The opportunity to be mentored by more experienced developers will also foster an environment where code is crafted with a security-first mindset and the precision required to take software to the next level.

    One key area that often gets overlooked is the user experience; particularly with regard to how users access information.

    Security misconfigurations accounted for 21% of cloud-based data breaches in the past year, and amateur-hour errors (like storing passwords in plaintext, for example) resulted in serious productivity and customer trust losses. To avoid these errors, aim for a secure user experience that weaves tight security into a flow that makes sense. Adding more barriers—complex password requirements, a CAPTCHA, a horde of flesh-eating zombies—can turn users away. On the other hand, getting too permissive with security measures renders the entire point moot.

    A successful, secure user experience needs to weave tight security into a flow that makes sense, presented in a way that doesn’t detract from anything compelling about the software. 

    Improved Developer Upskilling

    Developers, of course, want to write secure code, but they often lack those skills or need a refresher course. Meaningful training too often gets overlooked as the day-to-day needs of organizations allow for little time to improve skills.

    In working with developers, we’ve found that about 75% prefer structured on-the-job learning instead of opening a manual. They would rather learn by doing and want training focused on practical applications, something that most current training programs are missing.

    Look for any and all opportunities to upskill your developers. They are on the front lines when it comes to stopping vulnerabilities. Provide them both the time and right-fit resources, understanding that these efforts will pay considerable dividends in the future.

    Government agencies, in particular, face inherent challenges in keeping their systems secure. They often must manage outdated systems with few financial resources and fight for top talent in an incredibly competitive market. There is no panacea for removing vulnerabilities, but taking a proactive and preventative approach that emphasizes the customer experience with highly skilled developers can help agencies take significant steps forward.

  • Global Demand for Developer-Centric Security Fuels Secure Code Warrior’s Continued Growth

    BOSTON & SYDNEY & LONDON, August 24, 2021 — Global secure coding company Secure Code Warrior® has announced the signing of its 400th customer and strong business performance in response to an increased demand for security-aware and security-skilled developers across all industries worldwide.

    This milestone achievement follows the onboarding of 120 new enterprise customers across 30 countries within the first half of 2021—including major global retailers, technology juggernauts and manufacturing leaders—alongside doubling the number of licensed users and expanding over 30% of its accounts. In March, Secure Code Warrior signed the biggest customer deal in its company history, bringing an additional 33,000 developers into tailored learning pathways designed to help them deliver secure code faster.

    The recent customer acquisitions mean Secure Code Warrior is helping 400 organizations worldwide to improve developers’ software security skills, including Zoom Video, Reddit, Mastercard, the BBC, DBS Bank, the Singapore Government, TotalEnergies and Blue Prism.

    Pieter Danhieux, CEO and Co-Founder of Secure Code Warrior, said the company’s growth was driven by organizations prioritizing software security in the face of a growing global cyber threat landscape, and reflected the world showing signs of post-COVID recovery.

    “We have seen the ongoing impact of software-related breaches like SolarWinds and increased attacks on critical infrastructure influence government policies and business priorities across the globe. The likes of Biden’s Executive Order and Australia’s state-based cybersecurity strategies highlight the increased need to build developers’ security skills, rather than implement Band-Aid, after the breach ‘remedies’,” Danhieux said.

    “The necessity to foster security-conscious developers traverses industries, and we’re working with leading organizations to help secure the software that does amazing things in our world—from government bodies needing to safeguard national assets to automotive manufacturers securing connected systems in cars and beyond.”

    Secure Code Warrior’s flagship Learning Platform has been central to its success, with 85% of its customer base embracing the ‘Missions’ offering launched in late 2020, which foster developers’ security-first mindset through hyper-relevant, immersive coding simulations of real-world software vulnerabilities they are challenged to solve through secure coding in a safe environment. The scale-up has an ongoing focus on developing new challenges and has bolstered its platform to support nearly 60 language:frameworks including legacy, cutting-edge and specialized systems.

    Non-Executive Director on Secure Code Warrior’s Board and Silicon Valley veteran, Jim Pflaging, spoke highly of the scale-up’s strong growth amid the global pandemic.

    “Over the past 18-months, businesses have rapidly accelerated their digital transformation efforts. Now, growth and profitability are closely tied to engaging customers and suppliers with compelling software applications. The spate of high-profile cyberattacks throughout the same period have exposed weaknesses in software development practices, which the Biden administration’s Executive Order is combatting by stating secure coding should be foundational for any government or business entity. As a result, leading organizations worldwide are working with Secure Code Warrior to ‘shift left’ and reduce risk, while empowering teams to ship quality code faster by improving security at the most efficient stage of the software development process,” Pflaging said.

    To support its next chapter of growth and scale, Secure Code Warrior has made several key appointments to build and accelerate its go-to-market strategy, including Junie Dinda as its Chief Marketing Officer and Vikram Ghosh in the newly created role of Senior Vice President of Strategic Alliances.

    Based in San Francisco, Dinda held marketing leadership positions at Atlassian for over six years, most recently as VP of Marketing for Enterprise and Migrations. She brings extensive knowledge in driving product-led growth into the developer ecosystem and deep expertise in scaling hyper-growth businesses from 50 employees to billion-dollar organizations with 5,000+ staff.

    Ghosh joins following four years as Vice President of Business Development at Chef Software and has previously held senior leadership positions at Citrix and Microsoft. Based in Seattle, Ghosh is responsible for spearheading the growth of Secure Code Warrior’s global partner program, which recently announced significant enhancements and expanded integrations with leading DevSecOps vendors.

    To find out more about how Secure Code Warrior is securing the software that does amazing things in the world, visit securecodewarrior.com.

    About Secure Code Warrior

    Secure Code Warrior makes secure coding a positive and engaging experience for developers. Our flagship Learning Platform delivers relevant skills-based pathways for developers to write secure code at speed; whilst intelligent and contextual developer tools fix common security bugs in real-time. Through inspiring a global community of security-conscious developers to embrace a preventative secure coding approach, our mission is to pioneer a people-first solution to security upskilling, stamping out poor coding patterns for good. Established in 2015, our customers include major financial institutions, telcos, retail, governments and global technology companies across Europe, North America and Asia-Pacific. Learn more at securecodewarrior.com.