Should developers be responsible for application security?

[aamagasu]

Agile software development has inadvertently put security in the hands of developers--for better or for worse. Do your developers know this? Do they care? How do you and your security team ensure you're shipping secure software while still moving fast?

In this episode we speak with Guy Podjarny and Gareth Rushgrove about how we got where we are when it comes to security, which roles developers and the security team should play, and how to build security tools into the developer workflow in a way that is seamless. Check it out on iTunes or SoundCloud.

[Francesco Molino]

Hi

I'll listen to your podcast and this is an interesting and important question that comes around often.

I'm not a "real" developer but i deliver scripts and docker to customers to automate their operations.
I develop in Python essentially and since day one i use Sonarqube to do some testing.
Security concerns are to avoid breach while the script runs, protect any credential information....
Always looking for new methods to protect as much as possible what we deliver (not only the script itself but the machine on which the app/script runs onto)

[adamgroef007]

Champs will be informed by telephone or email. Hence, you will be approached to give your contact subtleties toward the finish of the overview.https://walgreenslistenscon.com/ 

[stephini]

1. First, developers need to have the proper training to know how to securely code web applications.  This is a key skill left out of most college course on programming.  Second, the developers and security staff need to develop Secure Coding Guidelines for each language used at the company.  These guidelines will provide the application developers with information on how they should securely code common functions.  It is important for security and the developers to work together to generate this document to ensure the guide is useful to developers, allows developers to code in an optimized fashion, and properly addresses security concerns.

2. Once developers have been trained and Secure Coding Practices have been established, the developers need to perform internal checks on the code they are developing to ensure the code is vulnerability free.  These internal checks help ensure the Secure Coding Practices are being followed and are a great way to improve developer’s knowledge of how to securely code web applications.  Throughout this process, the Security or Quality Assurance (QA) group should perform spot checks to make sure the internal developer code checks are being performed.

3. Once the application is coded, it moves into the QA process where the QA staff is responsible for identifying any defects in the application. Classically, QA testing has focused on testing the usability of an application and stress testing an application under load.  However, security vulnerabilities caused by coding are also a defect in the application, because a security vulnerability would allow the application to function in a way it is not intended.  Because of this shift, QA is responsible for ensuring the application is securely coded before it moves into production.  In many organizations large and small, the QA staff does not have the proper training in Web Application Security or the interest in growing that capability in house.  For those organizations, they should team up with an outside company that specializes in Web Application Security to have them perform the QA testing.

4. Once the application passes QA testing, it is time to move the application into staging, which is the final step before it moves into production.  At this point, Security should test the application.  During this test, it is critical the application be set up exactly as it would be in production.  This test must be performed by a group outside of QA and development to ensure the application is reviewed by a fresh set of eyes.  If the Security Department has the capabilities, they can perform this test.  However we find that many Security Departments do not have application security specialist on staff, so this is frequently outsourced to a third party. Security is ultimately responsible for making sure this test occurs and is performed by a qualified party.  WalgreensListen If any issues are discovered, development is responsible for making sure they are correctly fixed in a timely manner.

5. Next, the application moves into production.  To ensure the application remains secure, a number of steps must be taken.  All applications that are in production should have quarterly Black Box Scans and annual Grey Box Assessments performed on them.  These Assessments will test the applications for new vulnerabilities that may impact the application.  These steps are mainly the responsibility of the Security Department.  If any functional changes are made to the application, these changes should go through the complete security SDLC process.

[oconnerbrain492]

Their evaluators will put each of your observations under meticulous scrutiny, forwarding any and every valid comment to the administrators for implementation. https://walgreenslistens3000.com/ 

[daybossnew]

https://iwalgreenslistens.shop/ You can participate in the Walgreen Satisfaction Survey only in two languages: English or Spanish. Thus, you should have basic knowledge of any one of these two languages if you wish to be a part of the Walgreens Listens survey.

[Kshlerin]

MyCVSHR login

Agile software development has indeed shifted some security responsibilities to developers, especially with the rise of DevOps practices. In the Agile development model, software is released in small, frequent iterations, which can lead to faster development cycles. While this approach brings many benefits in terms of speed and agility, it also raises concerns about security vulnerabilities being introduced due to the faster pace of development.

In this context, it is essential for developers and security teams to work collaboratively to ensure the security of the software being shipped. Here are some strategies that organizations often use to ship secure software while maintaining a fast development pace:

1. **Security Education and Training**: Developers should receive training and education on secure coding practices and common security vulnerabilities. This helps them write secure code from the beginning.

2. **Security Review and Testing**: Implement security reviews and testing as part of the development process. This can include code reviews, security testing, and vulnerability scanning.

3. **Automated Security Testing**: Integrate automated security testing tools into the development pipeline. This allows for quick identification of potential security issues.

4. **Security Champions**: Designate security champions within development teams who are responsible for promoting security awareness and best practices.

5. **Secure Coding Guidelines**: Establish clear and concise secure coding guidelines that developers can follow during development.

6. **Threat Modeling**: Conduct threat modeling exercises to identify potential security threats and design mitigations early in the development process.

7. **Continuous Monitoring**: Implement continuous monitoring of the application in production to identify and respond to security issues promptly.

8. **Collaborative Culture**: Foster a culture of collaboration between developers and security teams, encouraging open communication and information sharing.

9. **Shift-Left Approach**: Emphasize a "shift-left" approach to security, addressing security concerns early in the development lifecycle.

By integrating security into the developer workflow and adopting a proactive approach to security, organizations can ship secure software while still moving fast and maintaining the benefits of Agile development. Regular communication between developers and the security team is key to identifying potential risks and addressing them promptly.