The future of security needs to put developers first

The pres­sure to be an always-on, ever-evolv­ing busi­ness today is enor­mous. It’s not enough to inno­vate: busi­ness­es must be respon­sive to new mar­ket con­di­tions that can change like the wind. But, added to all the dis­rup­tion and trans­for­ma­tion is the ques­tion of keep­ing every­thing secure. It’s a chal­lenge not every­one is pre­pared for.

Inter­net-based appli­ca­tions now play a major role in how com­pa­nies work with cus­tomers and deliv­er ser­vices: they’re the engine for this new-found agili­ty. Appli­ca­tions can be changed to meet new con­di­tions or cus­tomer needs many times a day, if nec­es­sary. But this has impor­tant impli­ca­tions for how com­pa­nies approach cyber­se­cu­ri­ty.

His­tor­i­cal­ly, Secu­ri­ty with a cap­i­tal ‘S’ has been a sep­a­rate depart­ment to Devel­op­ment. It would wait until code was ‘fin­ished’, then it would be test­ed and refined. But in real­i­ty, code is nev­er ‘fin­ished’, and these types of cum­ber­some, lega­cy process­es slow down inno­v­a­tive busi­ness­es, not allow­ing them to keep pace with their com­pe­ti­tion.

Today’s appli­ca­tions have two major char­ac­ter­is­tics. First, they’re cloud native – built and host­ed in the cloud rather than on the business’s own servers or data cen­tres. This allows them to scale and change direc­tion in min­utes. It’s a far cheap­er, more flex­i­ble way of stay­ing ahead of the curve.

Sec­ond, most mod­ern appli­ca­tions are cre­at­ed using the prac­tice of ‘DevOps’. Essen­tial­ly, it means the teams build­ing and run­ning the appli­ca­tions are one and the same. As a result, devel­op­ers can make a wider range of strate­gic deci­sions about the appli­ca­tion as well as mak­ing changes to it, as and when they need to.

In this flu­id world, where fast deci­sion-mak­ing is para­mount and appli­ca­tions are in a state of con­stant change, a sta­t­ic ‘sin­gle point in time’ approach to secu­ri­ty is sim­ply out­dat­ed and inad­e­quate.

Ulti­mate­ly, secu­ri­ty needs to be assim­i­lat­ed into the devel­op­ment process. But find­ing a way to meet rig­or­ous stan­dards with­out slow­ing down prod­uct evo­lu­tion or com­pro­mis­ing secu­ri­ty can be dif­fi­cult, par­tic­u­lar­ly if the rest of the busi­ness has yet to catch on to this mind­set. Snyk has a unique devel­op­er-cen­tric approach to cyber­se­cu­ri­ty and val­i­dates its vision for appli­ca­tion secu­ri­ty for glob­al enter­pris­es cur­rent­ly under­go­ing dig­i­tal trans­for­ma­tion.

To suc­ceed with a devel­op­er-first secu­ri­ty approach, busi­ness­es need to tack­le three key secu­ri­ty chal­lenges.

First, there is the curse of the expert. Devel­op­ers are high­ly skilled at find­ing effec­tive solu­tions to almost any gnarly prob­lem. But they aren’t nec­es­sar­i­ly also aware of cur­rent best prac­tice in using code to make sure they avoid secu­ri­ty vul­ner­a­bil­i­ties.

The sec­ond chal­lenge is build­ing on the work of a wider com­mu­ni­ty. In part, devel­op­ers are so fast and effi­cient at what they do because they can access a vast sup­ply of ready-made resources, many of which have been pub­lished as Open Source code. This code rapid­ly accel­er­ates projects and avoids rein­vent­ing the wheel, but it might occa­sion­al­ly have secu­ri­ty flaws. Devel­op­ers have nei­ther the time nor the exper­tise to ‘peel back the lay­ers of the onion’ when it comes to mak­ing sure there are no unpatched vul­ner­a­bil­i­ties lurk­ing in the back­ground.

Final­ly, sim­ple mis­con­fig­u­ra­tion can be a sig­nif­i­cant source of secu­ri­ty woes. Devel­op­ers can eas­i­ly cre­ate and manip­u­late large amounts of com­put­ing pow­er like vir­tu­al servers using soft­ware. But mak­ing sure they are always set up cor­rect­ly is a new ter­ri­to­ry, and not always a famil­iar one.

For com­pa­nies already unfa­mil­iar with the need to put secu­ri­ty at the heart of a new­ly tech-dri­ven busi­ness, these chal­lenges may seem like a moun­tain to climb. But, in most cas­es, it’s sim­ply a ques­tion of adjust­ing mind­sets and adopt­ing tools that are more appro­pri­ate to both today’s work and the future. Tools that assist devel­op­ers as they work, pro­vide solu­tions at the touch of a but­ton and, cru­cial­ly, that are them­selves con­stant­ly updat­ed and enhanced in real-time, just like Snyk, with mil­lions of devel­op­ers becom­ing more secure by lever­ag­ing our tools in their dai­ly work.

This devel­op­er-first approach is essen­tial. Adopt­ing a broad­er and deep­er approach to cyber­se­cu­ri­ty by embed­ding secu­ri­ty tools and best prac­tices through­out the soft­ware devel­op­ment life cycle is the make-or-break fac­tor in achiev­ing cloud native appli­ca­tion secu­ri­ty suc­cess.

For more infor­ma­tion please vis­it snyk.io

Spon­sored by

Snyk