Pieter Danhieux is the Co-Founder and Chairman/CEO of Secure Code Warrior.
As the complexity and volume of vulnerabilities continue to increase, it’s encouraging to see that software developers are starting to understand the vital role they can play in upholding cybersecurity best practices. According to the results of our 2022 State of Developer-Driven Security survey, nearly four of five developers believe that either they’re personally responsible for their code’s security or that every member of the team should be held accountable. Yet, 86% admit they struggle to practice secure coding. Our observations show that teams are frequently saddled with traditional training, which relies on outdated teaching methods that are neither engaging nor relevant to their current roles and skill levels.
This is why agile learning has emerged as a critical training methodology for high-impact upskilling of development teams. Instructors accommodate various skill levels while tying lessons to real-life scenarios. The lessons are built around just-in-time “microburst” teaching sessions, so teams learn, test and apply knowledge quickly and within the context of their job in addition to addressing their current security challenges. Instead of a “check-the-box” approach in which participants slog through online text, illustrations and videos, they get hands-on experience with a curriculum that prioritizes learning by doing.
Through agile learning, organizations can transform development teams that have very basic code defense awareness and skills into security-skilled advocates for code quality and resilience. The teams that practice security as a foundational part of code development as opposed to a frustrating roadblock to innovation can grow confident in their ability to build code that’s safe while speeding up their software release time. As a result of staying up to date on new threats and mitigation techniques, these teams can eliminate bottlenecks in the form of product rework and remediation due to vulnerabilities.
So, how do organizations enable development teams to reach this advanced state of security awareness and application? By incorporating the following best practices into training:
Tailor training to the needs of participants.
Customized curriculums prove critical here because different security skills are essential to address different security needs. In addition, most training offerings don’t consider how businesses shift and evolve during their lifetimes. They also don’t consider the potential for global scaling, as well as regional or vertical-centric compliance regulations and general requirements. Often, they don’t gather feedback from participants in developing the classroom materials. To avoid such shortcomings, organizations should seek out practitioners and platforms that leverage agile learning to cover all of this.
Swiftly segue from training to action.
Too often, teams view sessions as a distraction from day-to-day routines and responsibilities. Any training that interrupts their task completion—or can’t deliver the right education at the right time in an easy-to-grasp format—is unlikely to result in the acquisition of actionable and transferable security expertise. Agile learning allows developers to readily integrate lessons into their daily lives for purposeful educational opportunities, thus building security from the start while using the familiar coding tools they work with every day.
Keep content current and relevant.
Instructors and their platforms should constantly update materials with the latest breaches, vulnerabilities and new compliance standards. They must steer away from traditional approaches that are static, disengaging and irrelevant.
It’s heartening to see that so many developers want to take responsibility for securing their products. To emerge as truly informed advocates for secure coding, however, organizations must commit to upskilling that avoids content that’s disconnected from what they do. Think back to those earlier days of school: What worked best—sitting in a class and listening to a teacher prattle on in front of a blackboard about an outdated topic that doesn’t reflect students’ interests and challenges or getting interactive, hands-on instruction in a lab or computer classroom setting?
Agile learning opts for the latter. As a result, participants thrive by solving their actual problems in microbursts, which aids in greater information retention and engagement.
Attackers are always rapidly changing their playbook and launching new threats. Developers with enhanced risk intelligence can adapt to the changes in real time, deploying tools and techniques that help keep vulnerabilities out of their products so that adversaries can’t find a way in.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
