No love lost between security specialists and developers

Source:-zdnet.com

GitLab finds 68% of security professionals feel that less than half of developers can spot security vulnerabilities, but most people feel it’s a programmer’s job to write secure code.

Unless you’ve been under a rock, you’ve noticed hardly a day goes by without another serious security foul-up. While there’s plenty of blame to go around for these endless security problems, some of it goes to developers who write bad code.

That makes sense. But when GitLab, a DevOps company, surveyed over 4,000 developers and operators, they found 68% of the security professionals surveyed believe it’s a programmer’s job to write secure code, but they also think less than half of developers can spot security holes.

Whoops.

Everyone knows security needs to be baked into the development lifecycle, but that doesn’t mean it is. The survey showed long-standing friction between security and development teams remain.

Nearly half of security pros surveyed, 49%, said they struggle to get developers to make remediation of vulnerabilities a priority. Worse still, 68% of security professionals feel fewer than half of developers can spot security vulnerabilities later in the life cycle. Roughly half of security professionals said they most often found bugs after code is merged in a test environment.

At the same time, nearly 70% of developers said that while they are expected to write secure code, they get little guidance or help. One disgruntled programmer said, “It’s a mess, no standardization, most of my work has never had a security scan.”

Another problem is it seems many companies don’t take security seriously enough. Nearly 44% of those surveyed reported that they’re not judged on their security vulnerabilities.

So, if you’re under the gun to get the code out and you know no one’s paying attention to security, what would you do? That’s right. Hang security.

Underlining this, a recent study found that, left to their own devices, many freelance programmers didn’t bother to secure passwords in a business assignment. In short, many developers don’t think about security when writing code.

Great.

The survey may be new, but the clash between security and developers is ancient. As Linus Torvalds, Linux’s creator, once said, “security problems are just bugs.” And security hardening patches should never result “in killing processes. The only process I’m interested in is the _development_ process, where we find bugs and fix them.”

Torvalds continued, “From a security standpoint, when you find invalid access, and you mitigate it, you’ve done a great job, and your hardening was successful, and you’re done. “Look ma, it’s not a security issue anymore,” and you can basically ignore it as “just another bug” that is now in a class that is no longer your problem.”