Pull Rank on the Development Team

Application scanning is a useful tool, but it’s also fixing a problem 10,000 times rather than solving it once. If the 10 basic software flaws are so easy to avoid, why don’t developers do so?

The answer is that developers have two masters: features and deadlines. Until recently, security was not a feature. And dealing with it usually threatened a deadline. (There’s an adage among developers: Speed to market, number of features, level of quality. Pick two.)

"It’s why we published the 10 vulnerabilities," says Mark Curphey, chairman of the Open Web Application Security Project (OWASP), an open-source project that develops Web application and Web services tools. "Developers understand the vulnerabilities technically, but they don’t change how they code because of them. But when CIOs get the list, right away they understand."

Bring the list to a meeting with the person in charge of application development. Each of the 10 vulnerabilities can be assigned to either the development group or the IT-operations group, or in a few cases, both.

"As CIO, you need to be pretty intolerant of development that doesn’t address these basic issues," says Schmidt, the Arch Chemicals CIO who, as a former developer, has come to appreciate the need for a sit-down between the CIO and the head of developers. "Absolutely get talking. And bring some of the numbers on how much you save by catching bugs early. That data is out there." (See "Bug Economics," Page 62.)

Give QA Some TLC

The development culture that rewards features delivered quickly also scorns quality assurance (QA). Here’s how several developers view the code testing piece of QA:

• "Thankless."
• "Entry-level button pushing."
• "You know your career is advancing when you don’t have to do testing anymore."

At CUNA Mutual, Ferderer has recruited top developers and trained them to write secure code. He created a mentor program in which developers bring their code to their quality mentors and together they work on securing it. Ferderer says it’s early, but there’s anecdotal evidence that code quality is improving.

Make no mistake, forcing developers to get involved with QA puts you at the fulcrum of some wrenching cultural change in a guild whose practices are 30 years entrenched.

"There’s a fair bit of marketing involved because, no question, it’s a politically tricky situation," says the aforementioned unnamed divisional IS officer of a large bank. "No matter how you approach development, they’ll resist. They’ll say you’re threatening their timetables. If you’re a jerk about it, you end up losing and things don’t get secured."