It’s pretty concerning that a significant number of security breaches in organizations occur in applications, either through web application shortcomings or software vulnerabilities.
According to GitLab’s Global DevSecOps Survey 2020, there is a lot of disagreement regarding who is to blame for these breaches. The data shows that developers aren’t running sufficient DAST or SAST scans. Meanwhile, security professionals complain that developers identify bugs in applications too late in the process.
What’s the solution to such a problem? A security champions program.
Application security testing is the need of the hour for organizations that want to be secure. Although it’s a difficult task, a security champions program can enthuse teams to work together and build secure applications from the ground up.
Below, we explain why your team needs a security champion.
What Is a Security Champions Program?
A security champions program is a cross-functional approach where everyone in an organization plays a certain role in app security.
It’s important for everyone to be involved in security efforts, and not just developers or security professionals. However, forcing developers to do something they don’t understand is a terrible approach that will lead to sub-par app security.
The ratio of security professionals to developers in most teams is 1:50, making it difficult for the security team to offer its best. Your security team is unable to make up for the lack of security expertise among developers.
That’s where a security champion comes in.
A security champion in an application development team is an active evangelist that helps improve security and mitigate vulnerabilities in the development cycle. Security champions are select developers who act as resources for an organization’s security team.
On the one hand, they help the security team understand the processes undertaken by the development team. On the other hand, they assist development teams by educating them about secure coding practices to ensure the resulting applications are highly secure.
Since a security champion speaks ”both languages” (development and security), they can help bridge the gap between two fundamental segments of an organization.
To sum up, a security champion answers the questions for both parties, makes the learning curve smaller, and speeds up the delivery cycle while doing so.
Benefits of a Security Champion
A security champion helps reduce overhead and increase productivity throughout the organization. They can compensate for the lack of security skills in the development teams.
A security champion can help other company developers by::
- Educating other members about possible attacks against web applications, such as injection attacks or cross-site scripting (XSS) vulnerabilities that might lead to stolen passwords, session tokens, etc.
- Helping developers understand the basic origin of the OWASP Top 10 vulnerabilities, the risks these high-impact flaws can pose to the organization, and what they can do to mitigate these risks
- Sharing how to use security tools like static code analyzers to scan applications for possible vulnerabilities before conducting penetration testing
- Providing guidance on how the development team should manage authentication and authorization in applications
A developer with good security skills becomes more competitive because they have knowledge that other developers lack. By having a security champion in the development team, organizations can ensure that they’re secure on the development front.
A security champion can increase efficiency and reduce risk throughout an organization by making everyone on the team aware of common vulnerabilities and how to avoid them.
As more organizations move toward DevOps, it’s even more important for developers to be involved in security efforts. It’s no longer enough for organizations to buy an automated tool and expect it to work flawlessly.
Manual testing is required in modern software development.
It means that the responsibility of testing security vulnerabilities lies with the developer. Test-driven development (TDD) practices, where developers write unit tests before they write code, can be beneficial in the security realm.
The structure of a well-written test allows for developers to identify and prevent both logical and traditional vulnerabilities very early on in development cycles.
Responsibilities of a Security Champion
A security champion has the following responsibilities in the development operations:
- Being Knowledgeable. A security champion must keep up with the latest methodologies, practices, and tools for effective security.
- Being Proactive. A security champion must provide guidance to other members on how to identify vulnerabilities effectively and recommend what to do about them.
- Working Collaboratively with Other Teams. If your organization is transitioning toward DevOps, the entire development lifecycle becomes automated by implementing continuous integration (CI) systems. A security champion must work with other teams to ensure that the code is secure from development to production.
- Mentoring Other Developers. With an effective program, a security champion can provide hands-on training and education for developers who are new to security practices.
- Being Responsible for the Security of their Own Product. While working with other teams, a security champion must ensure that their code is secure from vulnerabilities.
As a security champion, it’s important to be a vehicle of cultural change. When an organization has a comprehensive approach to solution-driven development operations and teamwork, it can make progressive strides in its application and code security.
How Can Developers Work to Be Security Champions?
In order for a developer to move into the role of a security champion, they must have a strong understanding of security, application vulnerabilities, and related tools.
An organization may have internal training sessions or organize conferences, seminars, and other educational activities for developers to learn about the latest security practices. A prospective security champion should attend these events to keep up with new trends in software development.
It also helps to work alongside security professionals. It’s a daily routine for security professionals to discover new vulnerabilities as they carry out penetration tests. A developer can work alongside them to learn about the latest threats and how organizations are mitigating them.
More important is attending external conferences, meetups, and other similar events where developers share their personal experiences with others. OWASP’S Security Champions 2.0 playbook is a very useful resource in this regard.
According to it, security champions are expected to define best security practices, attend conferences, monitor vulnerabilities in libraries and tools, write security tests for risks, and prioritize stories relevant to security in Backlog.
Familiarity with solutions like Kiuwan is also a plus. Kiuwan is a code security solution for web and mobile application development operations that offers two products; Software Composition Analysis and Code Security.
Since Kiuwan is compliant with security standards like CWE, OWASP, PCI, CERT & SANS, being familiar with its use can help developers identify risks in code right when they’re writing it, allowing them to fix vulnerabilities earlier on.
Nexploit is another automated security testing tool that helps promote security awareness in security teams. It employs sophisticated algorithms to apply the right testing against the targets.
Tips for Fostering Security Champions
Irrespective of the size of the team, here are a few tips that can help create competent security champions.
Include Security Champions in Sprint Planning Meetings
Doing this helps other developers understand what needs to be done from a security perspective and allows them to find ways to prevent vulnerabilities before they arise.
A security champion needs to be a proactive member of the entire development team and not just a third-party service provider who performs penetration tests and reports bugs.
Set Attainable Goals
Set attainable and specific goals for the security champions so that all their actions are purposeful and result-driven. This is a great way for developers to identify coding errors that are already in production or will be included in future releases.
For example, when they’re asked to add functionality to an existing web app, they can use static analysis tools to assess the current state of code quality and identify potential vulnerabilities before writing the code.
Target Top Vulnerabilities
It’s important to identify the top vulnerabilities that are affecting the industry at present and are becoming a cause of concern among developers.
Not only will this ensure that security champions are up-to-date with current trends, but it will also make their work more streamlined as they approach the development process from the perspective of vulnerabilities.
For example, OWASP’s list of vulnerabilities has helped developers understand the most common security problems in web applications and how to prevent them.
Put a System In Place for Disclosing Security Issues
Security champions need to understand their responsibilities and how they can communicate security issues to developers in a responsible and ethical way.
It’s important to make sure that security champions understand the difference between responsible and irresponsible disclosure.
Establish a system for disclosing vulnerabilities directly to developers and security professionals before consulting with other parties like legal or product teams.
Final Words
Maintaining security during development operations may seem complicated, but with the right approach and support from security champions, it becomes simpler to ensure application security right from the beginning.
Fortunately, there are many tools these days that empower development teams to increase security awareness and implement best practices at the same time.Kiuwan is a trusted global organization that offers end-to-end application security and tools that help development teams identify vulnerabilities in their code.
