Three ‘Mission Critical’ Practices for any Development Team

Your company could (and should) be coding like NASA. That’s right – space-surfing, rocket-propelling, humanity-advancing, NASA. Whether you’re developing software to go to Mars or to order pizza with your sneakers, coding should follow a standard that ensures safety and security.

Nowadays, you’re likely developing a product or service that contains Personally Identifying Information (PII) or credit card information. Either that or it controls an IoT device. The fact is, these are all sensitive materials that could harm another person or location and there are three practices to consider to make sure they remain protected.

Keep humanity in mind.

If Michael Bay’s 1998 blockbuster Armageddon gave us any indication, apocalyptic asteroids are NASA’s greatest concern. This is not true as NASA spends more time protecting astronauts from its own technology than it does training boisterous oil rig workers to save the world.

Specific to coding, NASA has 10 base principles that should be considered for every product or service your organization is developing. These principles were established by Jet Propulsion Laboratory (JPL) lead scientist Gerard J. Holzmann and written with the C language in mind. Holzmann recommends C because of its long history and extensive tool support, although the rules can be generalized for coding in any programming language.

NASA’s rules are strict and add time to development if adhered to properly. That being said, NASA can’t afford to botch a project and these days, neither can tech companies. It’s this ‘measure twice, cut once’ mentality that gives Houston a sigh of relief and will prevent your company any future hiccups.

Highlight secure design.

Secure products are created when placing importance on secure design. Secure design is one step in a larger context which includes:

  1. Threat modelling.
  2. A Software Development Lifecycle (SDLC) including:
    1. Secure design.
    2. Secure coding.
    3. Secure testing and evaluation.
  3. Third party assessment of your product or service.
  4. Creation and implementation of a vulnerability disclosure and management process.
  5. Creation and implementation of an incident management process.
  6. Creation and implementation of a data breach process.

There are organizations out there that can support your company’s efforts in secure design. The International Organization of Standardization (ISO) provides world-class specifications for products, services and systems, to ensure quality, safety and efficiency. With over twenty thousand international standards and related documents published, ISO spans across almost every industry, including technology.

Another example is the Open Web Application Security Project (OWASP) – a not-for-profit organization dedicated to helping organizations conceive, develop, acquire, operate and maintain trusted applications.

OWASP has developed a number of tools to aid in secure design such as, the dependency check tool and ZAP proxy tool. Both tools help identify project dependencies and check if there are any known, publicly disclosed, vulnerabilities in both software and web applications.

Keep in mind that adding security at the front end of the product life cycle saves money on the back end for delivery when you’re calling your lawyer to deal with a lawsuit.

Teach safe ‘sets’.

Teaching an old developer new protocols is kind of like teaching an old dog new tricks – difficult. Many senior developers are set in their ways and find it hard to code with strict (but secure) guidelines. The same could be said for junior developers that graduate with great coding skills but poor security knowledge. Whether your development team is made up of seniors, juniors or both, training them to code securely is necessary to produce secure products and services.

Secure coding training is effective if implemented as part of the onboarding process. Your training should establish guiding principles and follow a secure design process. Providing a baseline for your developers and training grounds for testing is a surefire way to teach them how to code securely.

OWASP has developed another resource called WebGoat – a deliberately insecure web application maintained by OWASP to teach web application security lessons. It’s through these war games and hands-on security lessons where your developers will truly grasp the concept of secure coding.

Coding for the benefit of all.

When developing software for a product or service, think big and small. As you prepare your team for launch, make sure they’re equipped with the proper tools and protocols before all systems are go. Establish a proper baseline, training program and development plan before your developers start coding. Time, money and sensitive information will be saved. From here, highlight secure coding as ‘mission critical’ once a project is in flight.

This is easier said than done as the pace at which tech companies are expected to operate continues to accelerate. Set timelines with the rationale that when your organization does something, they do it right. Inform your clients there is more on the line than an unsuccessful project – human lives are often at stake.

Remember: whether it’s a rupture in a shuttle’s oxygen tank or a security breach in a piece of software, failure is not an option.

Written by: DarkKnight


About F Khan

Tech-junkie, with a special affection for security issues as they relate to telecom and enterprise, mobile, standards, social media, and gadgets.