Static Analysis Group (Archived) — ABacchi035478 (Community Member) asked a question.
Theres the obvious- "because they have to" but what other ways do you get them to change their mindset to participate?
Ask the Community
Get answers, share a use case, discuss your favorite features, or get input from the community.
By clicking “Accept All Cookies”, you agree to the storing of cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts.
.png){kind=logo}
These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.
These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.
These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.
Thats a great question, I don't really have a good answer, would love to hear from someone that has found something that has worked in their environment. I find that face to face followup works pretty good sometimes, creating some kind of relationship helps always.
Hello mwaldis335267,
My name is Darrell James and I am a Principal Security Program Manager with Veracode. I have seen 2 ways that seems to help:
Thanks Darrell- I am really intrigued by your second point around a hackathon activity. What if it was some type of inner-sourced bug bounty day where we give teams 10 applications that have been scanned and challenge them to fix as many flaws as possible and in the end submit merge requests to the apps with the fixed code.
That is a good option as well. You can also embed some education into the Hackathon activity. For example, you have certain types of flaws (as you initially mentioned) that developers may need to be educated on this would be a good time to do that. Maybe explaining the effects of an SQL injection versus just telling them to fix it is powerful. Or creating a simple application that has something like a comment box and showing how easy it is to inject scripts with no input validation, things like that. Lastly, solicit the developers to see if they have coding tricks or other knowledge they want to share at a Hackathon. It might not be directly related to AppSec, however, it will allow the developers to be more open and receptive to participation. I hope this helps.
Not sure if a hackathon would work in my environment, but what I have seen that has been helpful is to document some coding examples showing where flaws were found, and then showing a best practice like example of how that flaw was addressed, publishing that best practice coding document, this was big in resolving alot of null check improper null termination issues.
I think the fact that you are providing examples on how the flaw was published, versus just fix it (scan and scold) speaks for itself. I forgot to mention that you may want to look into looking for a Security Champion within the groups. That has lo been a good way to sustain develop buy-in. In my opinion, you are on the right track :).
Yes the security champion is a good idea, got that through BSIMM model which we are using as a development model
Great, that is a good framework, As notated above, you are working in the right direction. Just choose what you feel would be the "low hanging fruit" based on your environment; use that as a component of your baseline and work forward from there
Here are some ideas:
1) Provide visibility thru analytics and reporting. A dashboard for mgrs, directors, vp's - helps provide a top-down priority. Since it is easily measurable, getting management to add a metric to a performance review will help with keeping a security focus, especially for product owners.
2) For very common flaws that I've seen repeatedly across applications, I've provided documentation and remediation instructions, and code samples to lessen the time a developer needs to spend on it.
Above 2 points work great. I share our experience here.
1) To change high management's mindset comes before developer's. Our experience shows that high management usually can form a secure coding culture in their teams. Consequently, developers start sharing their secure coding knowledge, applying best practices in code and so on. It is a kind of "peer pressure" phenomena.
2) We do use internal wiki to share common flaws documentation and remediation instructions. Veracode does report CWE ID for each flaw, so it is very easy to refer to.