Security Training for Developers Failing to Keep Up With Threats

NEWS ANALYSIS: Multiple speakers at the RSA conference said developers alone are not to blame for the current state of cyber-security in which threats evolve faster than the defenses.

Download the authoritative guide: The Ultimate Guide to IT Security Vendors

Development Security 2

SAN FRANCISCO—It's the best of times and the worst of times to be a software developer. There are lots of jobs and business opportunities for developers, but thousands of new applications reach the market each day with inadequate attention to built-in security flaws.

Cloud computing, containers, new programming languages and continuous integration and delivery tools are changing the game and enabling developers to create new types of applications and reach new levels of agility. Despite all the opportunity, there's one area in which developers can't catch a break—security.

Here at the RSA Conference this week there was a lot of talk about Apple vs. the FBI and the coming security market consolidation. Dig a little deeper and the real issues confronting enterprise CIOs and security managers include the never-ending stream of insecure applications being put into production from vendors as well as corporate developers.

For enterprise developers, this is not necessarily their fault. They are facing, in geek speak, the Kobayashi Maru Star Trek command test scenario: They can't win. Either they push out apps quickly and insecurely, or slowly but more securely. Security processes and agile development methodologies require their own schedules and resources.

To that point, a new survey from CloudPassage found that 50 per cent of security professionals don't believe security is capable of moving as fast as app release cycles; 65 percent said a lack of resources and organizational siloes are the main barriers to security getting into release cycles earlier.

Businesses, seeing great opportunities in increasing developer productivity, are pushing developers to get apps out as fast as possible. Sometimes, security best practices are being ignored. More often, they are merely being put off until later. Software producers will wait to work on security until hackers find the product's weak spots. This symptom is already pervasive in the Internet of things. Experts who monitor and test application security call this "security debt."

Which kinds of applications are the ones causing the most problems?

"New ones. That's the reality," said Amichai Shulman, CTO of Web application firewall vendor Imperva. "There are not bad programmers or bad languages. It's mostly those apps that have very tight schedules—a very fast time to market—that are the most vulnerable. No one has enough time to weed out vulnerabilities and write secure code."

The biggest code culprit for security these days are APIs for mobile apps and server-side controls. Companies are creating mobile versions of their legacy applications and in the process generating security bugs. "Companies say let's go mobile, they mobilize the apps and they end up with APIs that are vulnerable," he said.

Again, business imperatives are not necessarily the developer's fault. Nor do security flaws occur because student developers are not getting enough training on writing secure code and preventing exploits like SQL injection and cross-site scripting.

It's also a simple numbers problem. IT industry research shows that over the next few years millions of cyber-security jobs will go unfilled.

Scot Petersen

Scot Petersen

Scot Petersen is a technology analyst at Ziff Brothers Investments, a private investment firm. Prior to joining Ziff Brothers, Scot was the editorial director, Business Applications & Architecture,...