Software development experts share their tips on improving the use of open-source software, deployment and governance, and improving data management.
The CIOs of their organisations and IT departments are under pressure from the business to automate processes, modernise apps, enhance customer experience, move applications to the cloud and improve workflows.
DevOps and Agile Development are the practices, automation, and tools that allow software development teams to achieve their goals, deliver greater business value, and do so faster.
Most advanced teams use fully automated Continuous Integration and Continuous Delivery (CI/CD), with test automation integrated and infrastructure-as-code deployment.
The most advanced development teams integrate agile tools with change management and incident workflows and AIops platforms to quickly identify the cause of production problems.
6 Security Risks of Software Development
Unveiling the hidden threats in software development! Learn about the six security risks of software development you should always pay attention to ensure robust and secure software.
Security issues persist in the software development process. Only 36% of ESG’s Modern Application Development Security survey respondents rated their program as 9 or 10 regarding application security.
Comparatively, only 36% of respondents rated their application security program a 9 or 10. The lack of security is due to a need for more technology, security consulting or service providers.
Cybersecurity Almanac 2020 lists more than 3500 security partners. The key to minimising security risks and delivering business benefits in software development is clearly communicating the security principles.
Also Read: Why Software Security is Crucial in The Modern World
#1. Security is not treated as an important DevOps citizen
Many organisations use best practices for security in Agile and DevOps. It’s easy to understand why agile teams prioritise other priorities, such as technical debt and business goals.
This conclusion is supported by the ESG study. Only 31% of respondents said that their security analysts review code and features. This is a large gap. Most organisations will likely need more security specialists to permanently assign them to agile development teams. Here’s what most organisations can do.
- Require that the entire software development team receive ongoing security training.
- Formalise the collaboration between Infosec and agile planners and release managers so they can identify higher-risk user stories and features early on in development.
- Record sprint reviews and make them public so Infosec can monitor more and identify risky implementations.
- All newly developed APIs and microservices must be subjected to the security testing requirements in their CI/CD pipelines.
The most effective way CIOs contribute to software security is by defining principles, encouraging cross-team cooperation, improving the culture and improving team happiness. According to the 2020 DevSecOps Community Survey results, happy developers were 3.6 times as likely to take security seriously.
Read: Can Your Business Automate Its Ransomware Response?
#2. Develop proprietary technical implementations
Organisations need the magic and innovation of software development teams to solve pressing business problems. Sometimes, however, requirements can send developers down a path that leads to solving technical problems and implementing solutions from third-party sources.
Often, low-code or no-code solutions can be more secure. This is due to at least two factors. Agile product owners may only sometimes be aware of the security implications associated with their most important features. Many need help formulating requirements without having to dictate solution elements. This can lead to teams implementing code-intensive, security-risky solutions.
The agile development team should start by asking product owners about the priority of features and then negotiate its scope and requirements. To do so without confrontation, you can enforce strictness in writing user stories and their estimation to ensure that complexity is exposed before coding occurs.
After the development team has agreed on the priorities and scope of the features, they should look at where third-party technology can be used in the implementation. The review should cover the following items:
- Platforms with low-code or no-code.
- Open-source libraries.
- Commercial frameworks.
- Public cloud services.
- Software-as-a-service tools.
Read: How Cybersecurity is set to Impact The Retail Industry
#3. Ineffective governance and management for open-source and commercial components
According to a recent article, DevOps is the most capable team to choose their tools. This is a belief that advanced DevOps team members often express. I’m aware of several DevOps publications which promote the same principle.
Many CIOs and IT leaders warn that DevOps should not be given the authority to decide which tools and components they will use. Most leaders acknowledge that complex approval processes and too many restrictions can slow innovation and frustrate developers. CIOs and IT leaders must create clear rules that are easy to follow and be governed sensibly. This includes technology upgrades and patches.
Recent findings from surveys illustrate these risks. Only 72% of IT professionals surveyed about open-source management and development reported that they had a policy for open-source use. And only 64% of them reported an open-source governance committee. This is only the beginning of the issue since 16% of respondents think they can fix an open-source security vulnerability after it has been identified.
Read: Top 10 Cyber Security Threats to Know
The results of this survey are alarming, considering the reported number of breaches involving open-source software components. According to the 2020 DevSecOps Community Survey, 21% of respondents admitted breaches involving open-source components. There’s more to it than open-source issues. Any commercial system could have vulnerabilities in its API or software components.
It is important to have clearly defined policies and practices about open-source usage, technology selection and lifecycle management to mitigate risk. However, organisations have different views on the best practices. Some are more open, and some less so. CIOs can balance innovation and security by establishing a multidisciplinary group to develop governance standards, metrics, and tools.
Open-source components can be easily selected using tools combining developer abilities and best security practices. Jay Jamison is the chief product and tech officer of Quick Base. He shared his insight on Quick Base’s open-source innovation strategy:
We are early adopters of GitHub’s Advanced Security. This makes it easier to find vulnerabilities within open-source software projects. It is a step towards bringing security into the early stages of software development, also known as shifting left.
Read: How to Prevent The Top 5 Cyber-Threats
#4. Access to source code repositories, CI/CD pipelines, and other tools
In-house software security involves:
- Locking down the version control repository.
- Scanning for code vulnerabilities.
- Setting minimum permissions to ease deployments.
- Encryption of connections and penetration testing.
The IT security team was responsible for locking down network infrastructure and the associated tools.
There are now more tools and integrations, as well as greater risks. Josh Mason, the VP of Engineering at Cherwell, spoke with me about Cherwell’s approach to code security. At Cherwell, we combine automated static analysis (SAST), human-driven penetration tests, and dynamic application security tests to improve productivity.
“By implementing SAST in the CI/CD pipe, the discovery phase is moved further to the end of the software development cycle. This results in faster and cheaper resolutions,” he explained.
Mason recommends that the repository for version control be locked down. It is important to limit access to the source control repository and its functions by following the principles of the least-privilege model.
The source control repository [solutions] Azure DevOps (GitHub), Bitbucket and others allow finely-grained permissions for users to restrict developers or entire development teams to a small portion of codebases related to their own work.”
Read: How Cybersecurity is set to Impact The Retail Industry
Rajesh Raheja is the head of engineering for Boomi, an enterprise owned by Dell Technologies. He recommends that development teams take on responsibility in several security-related areas. If the software isn’t properly developed, security risks are magnified much larger than when an individual system is breached.
You can reduce the risk by securing your CI/CD pipeline and locking down the systems using the principle of the least privilege. You can also implement certain automation workarounds with multifactor authentication.
#5. Securing sensitive data
DevOps teams may be familiar with security measures for testing, developing and deploying software. Still, they also need to incorporate security procedures around data management.
Chris Bergh explains how to improve data security and automate more operations. Data privacy and security issues prevent businesses from monetising data to gain a competitive edge. The issue needs to be bigger to be solved by manual processes – more data flows too fast.
Data ops is a challenge that CIOs, IT managers, and developers face. They must adopt proactive data governance and educate data scientists and developers on acceptable practices for data. Data security and privacy include centralised identity management, role-based rights, and masking sensitive data within development environments.
Data security is one of many things that must be considered when managing sensitive data. Many companies, particularly those in regulated sectors, must capture the data history showing when, where and how it changed. Many of these companies use data management and integration platforms that include data lineage features.
Also Read: Top 5 Data Privacy Trends
#6. Home security solutions and expertise
I have always sought out different expert opinions regarding risk management and security. Only some organisations likely possess the expertise required to deal with security threats.
When security problems arise, it is important to have a team of experts to call on to reduce risks, address issues, collect forensics and shore up vulnerabilities.
While tools and practices can help CIOs deal with today’s security issues, experts are needed to tackle future challenges.
