Matias Madou, Co-founder and CTO, Secure Code Warrior, says Secure-by-Design (SBD) requires a cultural shift in how developers approach security.
Can organizations fully embrace SBD in the next 5 years?
By 2030, governments across the UK, Australia and others aim to significantly improve software security, especially within critical infrastructure. But achieving this goal won’t happen through advanced tools or policies – it requires a cultural shift in how developers approach security.
Achieving SBD in organizations is a complex, evolving goal that depends on several factors, including the size of the organization, the maturity of its security culture and industry adoption.
However, on a broad scale, most organizations will need around 3-5 years to fully integrate security by design into their software development practices. What does it take to achieve this adoption? And can we create a culture that prioritizes SBD principles across every level of software development?
What is SBD and what are the biggest challenges organisations face when implementing it?
In essence, SBD is a commitment to prioritize security and incorporate security controls at the very start of a design or development process.
Many manufacturers have committed to this pursuit even prior to the global pledge and set of principles that were established a year ago. However, the biggest challenge most companies experience when trying to incorporate SBD principles is in its communication, adoption and acceptance within the organizational culture. Various companies are still prioritizing the speed of software delivery to the market at the expense of everything else which exacerbates the aforementioned challenges. SBD is not an initiative that is firmly established and followed by a “flip of a switch.” It’s a comprehensive, ongoing endeavor that ultimately upgrades our approach to secure software creation.
How can leaders drive a cultural shift within their organization to one that prioritizes a “Security First” mindset?
Emphasizing a culture built around the idea of continuous learning is essential. Because the most serious cyber threats involve data that exists in software, cultural change needs to begin with continuous learning and upskilling around secure code development. Ultimately, the work put into delivering a holistic, positive security culture that places developers as the driving force behind vulnerability detection and mitigation – or, ideally, not creating unsafe coding patterns in the first place – will determine an organization’s long-term success.
In what ways are emerging technologies, such as AI and machine learning, transforming the overall security landscape?
What is important to note is that AI itself is not inherently dangerous, rather it’s the unchecked use of AI tools that pose the greatest risk. With intensifying demand for faster code production, AI provides a tempting opportunity for developers looking to streamline their code development process. However, these AI shortcuts often lead to the minimization – or abandonment entirely – of code review for vulnerabilities, which directly introduces developer-driven risk to the codebase and compromises both data security and overall compliance.
While it’s certain that the current way developers create applications will evolve over the next few years, there is ultimately no replacement for an intuitive, security-focused developer who can apply the critical thinking required to mitigate the risk of both AI and human error.
How can organisations balance the need for security with cost and speed? How can organisations effectively support their developers while not sacrificing on overall security posture?
Striking a security/productivity balance is a key component to maintaining respect and accountability within developer teams. CISOs cannot keep teams from finding their own tools – nor should they. They need to be willing to allow relevant AI-related activity within certain established parameters, if it results in meeting production goals with minimal risks. In other words, CISOs should approach the creation of guidelines and endorsed processes for their developer teams with a mindset of: “We appreciate that you’re discovering new AI solutions that will enable you to create software more efficiently. We just want to ensure your solutions won’t cause security problems that ultimately hinder productivity. So let’s work on this together.” This welcomes a shift towards nurturing a developer environment that is collaborative, productive, and most importantly: striving for a unified goal of security.
How can organisations justify the investment in security upfront?
Just as AI has weaknesses in generating code, we have yet to see AI – or a singular scanning tool, for that matter – that can catch every vulnerability or weakness within a codebase. Deciphering security best practices and spotting poor coding patterns – the type that can lead to exploitation – has emerged as a skill that developers must prioritize, which companies must invest in at the enterprise level. We cannot replace the critical “human touch perspective” which anticipates and defends against increasingly sophisticated attack techniques. Forward-thinking CISOs endorse these learning activities and skills verification – while also ensuring safer coding practices and access control.
What are key metrics organisations can use to measure the success of their SBD initiatives?
Implementing a benchmarking program fortified by clear goals based upon industry baselines provides visibility into the security skills and progress of developers. Identifying success standards and measuring them in terms of skill levels, vulnerability reduction, training frequency and impact will ensure the efficacy of internal training programs and alignment with the industry as a whole. With this knowledge, organisations can create a “guided path” for developers, matching training and best practices with each individual skill level and role. Organisations will be able to compare their overall developer teams’ security success profile to that of other industry members and leaders, while welcoming opportunities for new training and learning methods.
How can organisations ensure SBD is not just a one-time implementation but rather an ongoing commitment throughout the SDLC/across every level of software development?
The key to making SBD initiatives work is not only giving developers the skills to ensure secure code, but also assuring their organizations that those skills are in place. Based on internal data, our team analyzed developer team readiness – and the results may surprise.
It’s virtually impossible to improve efficiently without a concrete idea of where companies are starting, and where they need to go. However, the implementation of a benchmarking tool – a metric that quantifies developer teams’ security competencies – can help provide these critical, comprehensive data points. These insights inform highly effective, developer-driven security programs that support successful SBD initiatives.
Looking at the regulatory pressures on organisations today, how do you think these may evolve over the next 5 years?
I’ve loved witnessing CISA’s SBD movement gain momentum worldwide, as countries commit to integrating similar guidelines and expectations into their respective cybersecurity strategies – with many of these nations also contributing to the original US recommendations. That said, the US government recently overturned a legacy Executive Order relating to AI regulation and safety guardrails, effectively ending development restrictions on AI and throwing into question the future of AI standards. This raises questions on the future of security entirely.
While this removal of compliance guardrails allows more space for innovation, it also depends on tech companies and individuals acting in a moral, safe manner, and this is something that cannot be guaranteed. The future state of AI – and organizational security overall, is likely going to get more difficult to navigate.
