Mature DevSecOps orgs refine developer security skills training
Some advanced organizations tackle DevSecOps with automated security for CI/CD pipelines and infrastructure, and will complete the picture with developer security skills training.
BOSTON -- IT organizations that plan to tackle developer security skills as part of a DevSecOps shift have started to introduce tools and techniques that can help.
Many organizations have moved past early DevSecOps phases such as a 'seat at the table' for security experts during application design meetings and locked-down CI/CD and container environments. At DevSecCon 2018 here this week, IT pros revealed they've begun in earnest to 'shift security left' and teach developers how to write more secure application code from the beginning.
"We've been successful with what I'd call SecOps, and now we're working on DevSec," said Marnie Wilking, global CISO at Orion Health, a healthcare software company based in Boston, during a Q&A after her DevSecCon presentation. "We've just hired an application security expert, and we're working toward overall information assurance by design."
Security champions and fast feedback shift developer mindset
Orion Health's plan to bring an application security expert, or security champion, into its DevOps team reflects a model followed by IT security software companies, such as CA Veracode. The goal of security champions is to bridge the gap and liaise between IT security and developer teams, so that groups spend less time in negotiations.
"The security champions model is similar to having an SRE team for ops, where application security experts play a consultative role for both the security and the application development team," said Chris Wysopal, CTO at CA Veracode in Burlington, Mass., in a presentation. "They can determine when new application backlog items need threat modeling or secure code review from the security team."
However, no mature DevSecOps process allows time for consultation before every change to application code. Developers must hone their security skills to reduce vulnerable code without input from security experts to maintain app delivery velocity.
The good news is that developer security skills often emerge organically in CI/CD environments, provided IT ops and security pros build vulnerability checks into DevOps pipelines in the early phases of DevSecOps.
Marnie Wilking, global CISO at Orion Health, presents at DevSecCon.
"If you're seeing builds fail day after day [because of security flaws], and it stops you from doing what you want to get done, you're going to stop [writing insecure code]," said Julie Chickillo, VP of information security, risk and compliance at Beeline, a company headquartered in Jacksonville, Fla., which sell workforce management and vendor management software.
Beeline built security checks into its CI/CD pipeline that use SonarQube, which blocks application builds if it finds major, critical or limiting application security vulnerabilities in the code, and immediately sends that feedback to developers. Beeline also uses interactive code scanning tools from Contrast Security as part of its DevOps application delivery process.
"It's all about giving developers constant feedback, and putting information in their hands that helps them make better decisions," Chickillo said.
Developer security training tools emerge
Application code scans and continuous integration tests only go so far to make applications secure by design. DevSecOps organizations will also use updated tools to further developer security skills training.
Sooner or later, companies put security scanning tools in place, then realize they're not enough, because people don't understand the output of those tools.
Mark FelegyhaziCEO, Avatao.com Innovative Learning Ltd
"Sooner or later, companies put security scanning tools in place, then realize they're not enough, because people don't understand the output of those tools," said Mark Felegyhazi, CEO of Avatao.com Innovative Learning Ltd, a startup in Hungary that sells developer security skills training software. Avatao competitors in this emerging field include Secure Code Warrior, which offers gamelike interfaces that train developers in secure application design. Avatao also offers a hands-on gamification approach, but its tools also cover other parts of the software development lifecycle such as application design,* which Secure Code Warrior doesn't address, Felegyhazi said.
Firms also will look to internal and external training resources to build developer security skills. Beeline has sent developers to off-site security training, and plans to set up a sandbox environment for developers to practice penetration testing on their own code, so they better understand the mindset of attackers and how to head them off, Chickillo said.
Higher education must take a similar hands-on approach to bridge the developer security skills gap for graduates as they enter the workforce, said Gabor Pek, CTO at Avatao, in a DevSecCon presentation about security in computer science curricula.
"Universities don't have security champion programs," Pek said. "Most of their instruction is designed for a large number of students in a one-size-fits-all format, with few practical, hands-on exercises."
In addition to his work with Avatao, Pek helped create a bootcamp for student leaders of capture-the-flag teams that competed at the DEFCON conference in 2015. Capture-the-flag exercises offer a good template for the kinds of hands-on learning universities should embrace, he said, since they are accessible to beginners but also challenge experts.
*Information updated after publication. Felegyhazi clarified in an email that threat modeling on Avatao is still under development.
Dig Deeper on Agile, DevOps and software development methodologies
