Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operations

4/5/2018
10:30 AM
Caleb Sima
Caleb Sima
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
100%
0%

How Security Can Bridge the Chasm with Development

Enhancing the relationships between security and engineering is crucial for improving software security. These six steps will bring your teams together.

There's always been a troublesome rift between enterprise security teams and software developers. While the friction is understandable, it's also a shame, because the chasm between these teams makes it all the more challenging to build quality applications that are both great to use and safe.

Why is the strife between security teams and software developers so acute? Essentially, it's because both teams have, to a large degree, opposing goals. For security, it's about ensuring that apps are not easily exploitable and reasonably secure versus, on the development side, creating new applications and features for existing ones. There's no way to avoid the conflict between these two objectives, which reflect two very different and deep areas of expertise.

Another contributing factor is that today's enterprise technology has shifted from a focus on IT and infrastructure to being driven by software. And, frankly, security hasn't kept up with its out-of-date operations and infrastructure worldview, which has exacerbated the challenge.

The reality is that both software development and security are hard. The mindsets - breaker verses builder — are completely different. And we as security professionals need to take different approaches than we have in the past. Let's take a deeper look at these challenges, and then how security teams can help close the gap.

Be transparent. Connect with members of the development team and take time to understand their own processes and objectives. Walk in with an open mind and simply ask for their help. Engineers love solving problems. Be open to letting them help with the solutions to software security issues. This allows you to work with — and not against — development teams and enlist them as part of a solution, not condemn them as part of the problem.

Keep it simple. Developers are our customers, and our job is to help provide a service that makes their jobs easier. Apply this idea to everything. From helping to automate interactions between teams to what policies are really required to how results are delivered.

No more OWASP Top 10. Forget tackling the entire OWASP Top 10 — at least not all at once. Consider focusing on your own OWASP Top 2. Concentrate upon diligently eliminating certain classes of vulnerabilities in your organization over time. This eliminates creating a horribly long, seemingly insurmountable, list of items that are typically delivered to software engineering. A shorter, focused list enables the development team to easily slip into small sprints and fix errors. It's about quality, not quantity.

Deliver results development teams need. If your organization uses automated scanning tools to identify software flaws, then it is the security team's job to ensure that results delivered to the team are free of false positives and are high quality. This applies to anything from static to dynamic scanning or bug bounty programs. Filter and eliminate as much noise as possible.

Hire engineers. Talent is always a tough thing to find, but when it comes to hiring experienced security employees, it is even harder. It's almost impossible. So, instead look for talent in quality engineers, DevOps, and software development. It is 1,000% easier to teach security to this technical talent pool than to take a tools and operations security professional and teach them engineering. Security is a hot market, and I see a lot of interest from professionals in these groups to try to figure out how to move into cybersecurity.

Align goals. Keep in mind that most engineers want to write secure code and that they find security problems fascinating to solve. The challenge here isn't personal; it's often organizational and a lack of proper goal alignment. Too often there isn't enough time and energy allowed to be invested in solving security problems. This is driven by the organization and company goals and not the fault of developers. So, the single most effective thing a CISO can do to close this chasm is to create and pitch a higher initiative for the entire company to rally behind. Such a pitch can be as simple as a vision that Quality Software = Performance, Functionality, and Security.

Building secure software is much needed in the world today and will continue to be so tomorrow. We have traditionally focused our priorities on technologies that patch, watch, or block because this is easier. This reasoning needs to evolve and get in line with current (and future) security needs — and that means building secure software and automation. Security needs to be more engineering focused, come to a better understanding of secure development, and make it a priority.

Related Content:

Interop ITX 2018

Join Dark Reading LIVE for an intensive Security Pro Summit at Interop IT X and learn from the industry’s most knowledgeable IT security experts. Check out the agenda here.Register with Promo Code DR200 and save $200.

Caleb Sima has been engaged in the Internet security arena since 1994 and has become widely recognized as a leading expert in web security, penetration testing and the identification of emerging security threats. His pioneering efforts and expertise have helped define the web ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18214
PUBLISHED: 2019-10-19
The Video_Converter app 0.1.0 for Nextcloud allows denial of service (CPU and memory consumption) via multiple concurrent conversions because many FFmpeg processes may be running at once. (The workload is not queued for serial execution.)
CVE-2019-18202
PUBLISHED: 2019-10-19
Information Disclosure is possible on WAGO Series PFC100 and PFC200 devices before FW12 due to improper access control. A remote attacker can check for the existence of paths and file names via crafted HTTP requests.
CVE-2019-18209
PUBLISHED: 2019-10-19
templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer.
CVE-2019-18198
PUBLISHED: 2019-10-18
In the Linux kernel before 5.3.4, a reference count usage error in the fib6_rule_suppress() function in the fib6 suppression feature of net/ipv6/fib6_rules.c, when handling the FIB_LOOKUP_NOREF flag, can be exploited by a local attacker to corrupt memory, aka CID-ca7a03c41753.
CVE-2019-18197
PUBLISHED: 2019-10-18
In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclo...