Improve Secure Software Development and Time to Market with SD Elements
Understanding the Dynamics of Development and Security
Despite years of security concerns, most organizations still take a “features first” approach to building software. From the viewpoint of development teams this makes perfect sense. They are primarily measured by their ability to deliver a fixed set of features by a specific date. Building “secure software” may be a goal, but it is often difficult to articulate beyond an unreasonable expectation of “no vulnerabilities.”
Further, security has long been viewed as an obstacle to meeting schedules for functional requirements. Separate security teams would take builds from development, run them through various scanners, and return a list of bugs. Often, this would occur late in the software development lifecycle (SDLC), making rework to address “security issues” particularly costly. The result is frustrated development teams working without clear security guidance.
Consequently, security initiatives are often met with resistance from development teams. It is not that developers are opposed to secure coding. Rather, secure development practices have been incompatible with Key Performance Indicators (KPI) used to measure software engineers. Additionally, security compliance has not been treated as an application or software readiness feature. As a result, there is a continued focus on delivering features over security.
So, how do you make your developers care more about security?
Challenges Applying and Enforcing Secure Coding Standards
Some organizations will attempt to take a top-down approach and simply mandate that developers produce more secure software. This usually means more frequent security testing using scanning tools like static application security testing (SAST) and software composition analysis (SCA). By moving scanning earlier in the development process, organizations believe they are following a “shift left” strategy to “build security in.” Simply testing earlier is half the answer and often delays releases as developers are left to investigate false positives generated by the scanners.
Other organizations may attempt to provide secure coding requirements based on the expertise of a small group of senior development and security personnel. These manual exercises suffer from several challenges:
- Scalability: Identifying threats to an application and which secure coding rules to apply requires senior security and development resources to discuss architecture, produce data flow diagrams, and select controls. These resources are scarce (therefore expensive) and in high demand. Allocating for days or weeks to these exercises is not practical in most organizations for a single project, much less an entire application portfolio.
- Consistency: Ideally, organizations will identify risks and apply consistent controls. However, the output from secure coding exercises reflects the knowledge and biases of those participating. As team members change, identified risks and controls will also change.
- Accuracy: Few organizations can track the overlapping requirements of today’s compliance landscape, whether from regulatory standards or customer supply chain concerns. Ensuring that all threats are considered and the correct countermeasures are applied is beyond the capabilities of manual processes.
- Auditability: Secure coding controls are often maintained in a spreadsheet or shared document and updated via email messages. This provides poor evidence of compliance with corporate policies and regulatory standards.
Enhancing a “Features First” Culture to Include Security
Shifting security left efficiently requires integrating security into the requirements and design phases of the SDLC. Most exploitable weaknesses in an application are inherent to the technical stack of the application, including programming languages, frameworks, services, and deployment environment. When teams can identify these in the requirements phase of the SDLC, they can also specify approved security countermeasures and controls to mitigate threats to an application. This allows development teams to understand – in detail – all security expectations as requirements before writing code and make security activities part of the workflow.
It is important to remember that developers want to produce more secure software but likely have not received training. Few universities require security coursework in their computer science programs. To build secure software efficiently, they need the tools to identify threats and guidance on consistent controls to mitigate risk. This requires organizations to:
- Articulate and prioritize security requirements: Clearly defining security requirements helps developers understand what needs to be protected and why. Secure coding policies should be translated into consistent, practical, and actionable tasks. Prioritizing these requirements ensures that the most critical security aspects are addressed first, reducing the risk of significant vulnerabilities.
- Integrate security requirements into their regular workflow alongside functional requirements: Security should be an integral part of the development process rather than an afterthought. Embedding security practices into the existing workflow becomes a natural and consistent aspect of software development. It can also help to integrate these tasks as key results they must achieve to underscore that the business’ security goals feed the dev team’s performance goals.
- Provide developers with training: Training developers on security concepts and how security requirements help build secure code more efficiently will help reduce friction between security and development and help ensure developer buy-in.
- Support Your Technology with the Right People and Processes: Having the appropriate technology is crucial, but it must be supported by skilled personnel and well-defined processes to maintain security effectively.
How Security Compass Helps
Security Compass provides organizations with technology, processes, and – when desired – people to ensure success and rapid time to value.
Technology
Security Compass’ SD Elements is a developer-centric platform for automating secure development requirements and building secure and compliant software by design. Based on a brief survey or diagram import, SD Elements identifies applicable regulatory standards and threats to an applications technology stack and deployment environment. It then prioritizes risks to align development and security goals, translates threats into actionable security controls, and assigns them to development, QA, security, and operations through the teams’ existing systems, such as issue tracking systems.
SD Elements acts as a “security recommendation system” that enables development teams to build secure applications and comply with security requirements in a platform that is:
- Scalable: Security experts and senior development resources are scarce in all organizations. SD Elements automates building secure coding requirements in a self-service model. This allows organizations to scale secure coding standards across their entire application inventory without increasing demands on senior and scarce security resources.
- Consistent: SD Elements provides teams with professionally curated security controls, including coding samples and test plans, to ensure that teams apply consistent and effective controls. Extensive secure coding policies are included with SD Elements, or organizations can add their policies.
- Auditable: Tracking evidence of compliance with hundreds of security controls using spreadsheets and documents is subject to error. SD Elements solves the problem with spreadsheets by providing a centralized repository for all activity and all actions. Alternatively, teams can leverage SD Elements’ built-in integration capabilities to sync with leading issue-tracking systems.
- Accurate: The SD Elements Security Content and Training Library covers compliance requirements for standards including HIPAA, GLBA, PCI, ISO-27001, DIACAP, privacy requirements including GDPR, California Privacy Act, and PIPEDA, and industry standards like NIST 800-53, 800-82, and others, ASD-STIG, OWASP Top 10, and SANS Top 25 to ensure full compliance.
- Just-in-Time Training Modules: SD Elements delivers contextual learning directly to developers’ workstations when desired. Brief Just-in-Time Training (JITT) modules are mapped to security requirements and countermeasures and delivered to developers through their existing workflow without shifting context.
Processes
SD Elements provides stakeholder-specific reporting for teams in a centralized, controlled, and auditable environment, documenting all activities related to project weaknesses, controls, and mitigation efforts. Teams can quickly generate reports on system weaknesses identified by SD Elements and the completion status of controls. The executive dashboard offers key control metrics, such as the status of risk mitigation across the organization. Trend reporting can demonstrate how SD Elements positively impact the organization’s Objectives and Key Results (OKR). Additionally, all reporting data in SD Elements is available through its API, allowing integration with centralized executive dashboards using a data visualization tool.
People
No organization has unlimited resources. Security Compass’ Customer Success and Services (CS&S) teams are also available to help organizations that want assistance in achieving adoption and quick time to value. They can provide collateral and best practices around any organization-specific challenges, as well as training and strategies for adopting SD Elements to execute the organization’s security vision and integrate seamlessly into developer workflows to ensure a true start left to build secure and compliant software by design.
Some of the strategies the CS&S team has helped implement include the following:
- Gamification: Gamification allows developers to engage in the completion of countermeasures using techniques typically used in games, like high score (e.g. highest number of countermeasures completed or the highest number of vulnerabilities avoided), rewards (e.g. corporate swag, gift cards, or public recognition to individuals), and team play (e.g. organizational recognition for teams with projects in compliance). Our team can help design these and ensure that the gamification is easy to understand, relevant to the developer’s context, and aligned with your organization’s goals.
- Cross functional participation: It often helps invite development teams to participate in the new process definition. When security teams attempt to plan all the implementation alone, pushback can occur. Team members can better shape the technology rollout to fit the organization’s culture and policies by involving development, QA, security, and operations.
- Guided Rollouts: CS&S has helped customers scale their security coding programs to over 100 apps in a single year. If desired, the Security Compass customer success team can provide new teams with a “guided rollout” for their initial application. This assistive approach can address any questions or concerns that development and security teams may have in one-on-one settings. This can include modeling an application, discussing countermeasures in scope, verifying the completed tasks, and implementing them in production.
- Scaling deployments: Our CS&S team has deep experience deploying and scaling SD Elements. We have helped many customers scale their security coding programs to over 100 apps in a single year.
- Ongoing Support: Organizations are not static. As your team changes, CS&S supports existing and new members with “organizational memory” on your deployment and workflow, helping to maintain momentum and productivity.
Next Steps
SD Elements is a force multiplier for organizations seeking to build secure software. It enables a secure-by-design approach to software and product development by automatically generating security requirements and secure coding standards during the design and requirements stages of the software development lifecycle.
To learn more about how Security Compass and SD Elements can transform your development processes and enhance your software security, schedule a demo with our team. Contact us today to see how we can help you shift left and improve developer productivity.