Software Security: Time for a Rethink

This guest post was contributed by Laszlo Drajko, Partner and Founder of Cydrill.
In today’s interconnected world, the question isn’t whether your business will face a cyberattack, but when it will happen and how devastating the financial and reputational fallout will be – all of which depend on the security measures you have in place. 
Development teams are overwhelmed and unprepared
Development teams are under constant pressure to rapidly deliver new software due to shorter lead times, evolving customer demands, and fierce competition. Studies have shown that they spend more time maintaining, testing, and securing existing code rather than writing or enhancing it. This reactive approach perpetuates vulnerabilities and fails to address the root causes of security issues. Moreover, the demand for software to drive our modern world far exceeds the number of developers who can code it securely. This growing gap presents a significant risk, as software developers lack the necessary training and organizational support to effectively tackle cybersecurity threats. As a result, the same vulnerabilities keep cropping up in their code, leaving systems exposed to potential attacks. 
AI appears to offer a promising solution for addressing the challenges of combining speed and security. However, the reliance of AI systems on machine learning with vast internet-sourced datasets introduces new vulnerabilities. Hackers can manipulate data to deceive AI systems into taking malicious actions, thus presenting new cyber threats, as demonstrated by the incident earlier this year involving Hugging Face.
The Cost of Software Bugs
Exploited vulnerabilities can result in massive financial losses, often amounting to millions of dollars, as seen in the past with the Heartbleed, Log4Shell, and Microsoft Exchange cases. The cost of addressing less severe vulnerabilities can also be substantial, especially if they are discovered late in the software development lifecycle. Regrettably, many security vulnerabilities emerge post-deployment, even though they could have been mitigated earlier with the proper tools and methods. Identifying design flaws or security issues during the early phase of software development is far more cost-effective than fixing them during testing or post-deployment. Ideally, developers should aim to prevent these flaws from reaching production altogether.
Cybersecurity measures lag behind
In response to rapidly changing market demands, companies have increasingly adopted cross-functional methodologies, such as DevOps, allowing development teams to swiftly adapt to business needs. By integrating security practices into the DevOps culture, we’ve witnessed the emergence of DevSecOps, which emphasizes automating security checks and identifying vulnerabilities during the build phase. However, while this is a positive step, it primarily addresses the later stages of the SDLC, leaving earlier phases still vulnerable.
For a secure development lifecycle, companies should consider comprehensive approaches like the Microsoft Security Development Lifecycle (SDL) and descriptive frameworks such as OWASP SAMM and BSIMM. These methodologies advocate integrating security into every stage of development.
The question remains: is this sufficient to secure our systems? 
The solution: upskilling developers with secure coding 
Businesses must invest in developer-driven security to mitigate risks and avoid costly delays and reworks caused by vulnerabilities slipping through the gaps. Providing developers with the necessary training and resources to understand and implement secure coding practices is crucial for building a more resilient software landscape. As for the integration of AI into software development processes, possessing secure coding skills is key to ensuring its secure utilization.