Do you think that the ability to write a secure code is enough or companies have to introduce special trainings for their stuff?
The damage that cyber threats bring to companies is estimated at millions of dollars. A good web developer should always pay proper attention to cyber risks when working with applications in order to protect both employers and end users, as there is quite a large variety of cyber threats, take just buffer overflows, cross-site scripting (XXS) or SQL injections. Some say that the ability to write clear and secure code is the most important thing that can make applications secure.
Still, there’s also another point of view: it is of a great importance to raise the employees' awareness, including web application developers, in the area of cybersecurity to reduce the number of data leakages. Employees should be provided with trainings to gain knowledge on the possible security threats during the work process.
What do you think lies at the basis of a company’s security? Do you think that the ability to write a secure code is enough or companies have to introduce special trainings for their stuff?
There's a reason there are bug bounty programs. Very rarely would an application be absolutely unbreachable, and even if the application itself is, then the infrastructure in which it resides may not be.
There's a range of options for improving security in general.
We've dealt with all of these at smartbnb.io
Training and courses are good, but will only take you so far.
I think that simple things like code reviews with checklists that cover security topics, weekly knowledge-share meetings (someone presents a topic every week), test suites, and other processes have long-term impact on the quality and skills of the team, as well as encouraging better team work.
If the company is large, I have good experience with security-champions - those are skilled developers who are part of the teams, and are more minded to security. They help the security team to make sure that security concerns are maintained in the teams. They can get deeper training from security team, and spread that knowledge in their team
I think they need to weight the business risk before implementing anything. Because the additional testing will take time and might slow a IH to pushing something to market. Nothing will be fully secure but you can take certain steps to make yourself/company landing page less of a target.
I like to use the "Don't be the slowest person when driving on the highway " because they are likely to be pulled over first.
This comment was deleted 6 years ago