From the Blogosphere
Make Security Part of Your Development Lifestyle | @DevOpsSummit #Cloud #DevOps #Security
It is my firm belief that developers today are not focused on security during periods of head-down development
Jun. 30, 2016 02:24 PM
It is my firm belief that developers today are not focused on security during periods of head-down development. I would love to know the percentage of web developers that know about the Open Web Application Security Project or OWASP. This non-profit organization is simply focused on the secure development of web applications. Their education and guidance is freely available to the public yet I do not read much about security in the public development circles, blogs, etc.
OWASP first published a book called the Code Review Guide in 2006. In 2006, I led a team on the development of a large web application for the administration of the Women, Infants, and Children (WIC) program for the state of Massachusetts. We were doing weekly code reviews and our focus was on best practice and quality development of the software. Quality code is secure code.
OWASP had noticed in their 2006 publication where organizations had implemented a proper code review function into their software development lifecycle (SDLC), they enjoyed remarkably better code from a security perspective. The team code review does not, however guarantee a security consideration or security focus on the architecture, designs, patterns, or methods being implemented. This consideration must come from the developers themselves.
Security of IT infrastructure, products, or services starts from within. Who creates these infrastructures, products, or service offerings? Your development staff, team, or group(s). They also define the level of security that protects your assets. We all need to create a sense of urgency across the entire IT department. And, it starts with you.
The development staff would operate within a culture of creativeness. If it can be done, we'll do it. The developers would figure out all the ways to bypass the in-place security practices and get the job done. In many cases, these practices were unknown to the software development manager or director. This culture still exists today within many organizations. DevOps is an attempt to place a trusted liaison between the distrusting network folks and those flip-flop-wearing, loose-cannon developers. It sounds promising. We now have a true mediating faction to resolve process conflicts between camps. Discrimination between the cultures will now be non-existent. This is not my belief.
If you are a homeowner, you probably lock the doors at night. You take care of your home and you protect your investment. Your home is your shelter. It's safe and secure. I've had the mind-boggling opportunity to work with developers from around the world that assumed no ownership whatsoever of the code they were responsible for. That's ludicrous. This gives me the sense of urgency to correct this problem even though it's not my responsibility. It makes me want to add the bullet - accountable for the quality of your code to all these developer opportunities that ride the internet daily. Emails authored by senior talent recruiters and technical companies, that provide talent to our enterprises, and do not know what their clients really want in a software developer.
We need to consider security with every project start, code review, and subsequent release of the software. We should also do a threat model during the inception phase or just before we start development. We should do another threat model just before the first release and also discuss the model with each subsequent release. Security should be how we roll my friends. It should be our new lifestyle. Whether the code belongs to you or your employer, it should be the best that it can be. That depends on you solely.
Latest Cloud Developer Stories
Subscribe to the World's Most Powerful Newsletters
Subscribe to Our Rss Feeds & Get Your SYS-CON News Live!
SYS-CON Featured Whitepapers
Most Read This Week