Security Training for Developers Failing to Keep Up With Threats
NEWS ANALYSIS: Multiple speakers at the RSA conference said developers alone are not to blame for the current state of cyber-security in which threats evolve faster than the defenses.SAN FRANCISCO—It's the best of times and the worst of times to be a software developer. There are lots of jobs and business opportunities for developers, but thousands of new applications reach the market each day with inadequate attention to built-in security flaws. Cloud computing, containers, new programming languages and continuous integration and delivery tools are changing the game and enabling developers to create new types of applications and reach new levels of agility. Despite all the opportunity, there's one area in which developers can't catch a break—security. Here at the RSA Conference this week there was a lot of talk about Apple vs. the FBI and the coming security market consolidation. Dig a little deeper and the real issues confronting enterprise CIOs and security managers include the never-ending stream of insecure applications being put into production from vendors as well as corporate developers. For enterprise developers, this is not necessarily their fault. They are facing, in geek speak, the Kobayashi Maru Star Trek command test scenario: They can't win. Either they push out apps quickly and insecurely, or slowly but more securely. Security processes and agile development methodologies require their own schedules and resources.
To that point, a new survey from CloudPassage found that 50 per cent of security professionals don't believe security is capable of moving as fast as app release cycles; 65 percent said a lack of resources and organizational siloes are the main barriers to security getting into release cycles earlier.