/ The Big BAD Source Code Issue pt.1

Alright, this week is a bit of a remix, but I think it'll be worth it.

This week's newsletter is all about security and source code.

Whether you are on offense, defense, or attempting to uplevel your security program as a security leader, protecting your source code in the realms of application security and product security is a must.

This week, we're going to go over a bunch of my favorite free resources for secure code training.

With these resources, you can uplevel your whole organization. Code literacy is a superpower.

/ Why security code literacy?

First, we're going to discuss offensive practitioners. This is for all of you pen testers, red teamers, application security engineers, and more. When I started doing offensive security many years ago, I was not code literate, and it led to years of confusion and toil when assessing web applications and associated technologies. Eventually, when I landed at Fortify Software, I was exposed to secure code scanning. I jumped headfirst into understanding some of the paradigms that lead to vulnerabilities. Now, this didn't mean I had to become a full-stack developer. By studying the types of vulnerabilities code scanners use and how they occur, you can start to develop a sixth sense for just auditing code, even without being a full developer. Once I started to learn how to assess and read code, in my later career, I noticed that my pen tests, red teams, and pretty much everything else started flowing a bit smoother. It's by no means mandatory, but like I said, it can be a superpower in a lot of situations.

Now, for blue teamers and purple teamers, it doesn't matter if you are in the SOC, in threat intelligence, in detection engineering, or some hybrid role that does purple teaming. Knowing how vulnerabilities present themselves in code will absolutely come up in your job at some point. Not only knowing where vulnerabilities are but just being code literate is extremely important at the higher echelons of any of these disciplines. The sooner you can get some familiarity, the better.

Lastly, for my leaders out there—and this one is an important one—many security programs have one foot still stuck in an era where we didn't have great education or tools to do application security. Rewind five or six years ago, and we were still dynamically scanning everything, and the tools themselves were just starting to reach maturation for code scanning. We didn't have as many developers in security as we do today, and frankly, the frameworks weren't as difficult to find bugs in. Today, pretty much the inverse of all of this is true. And if I can give any security leader one piece of advice, it is to try and cultivate a culture of engineering and code literacy in your security program. Some of the best moves I've ever made as a security leader were to encourage my teams to build and fix things rather than just break and point them out. These teams helped build stronger cultures with our developers and IT and were always appreciated with fewer squabbles between security and any other group. Encouragement like this to build a program like this comes from leadership, and it is your job to make sure that your team is heading in the right direction for you to have an Engineering First security program.

/ The Goods

10 Free Resources for Secure Code Goodness

#1

#2

#3

#4

#5

#6

#7

#8

#9

#10

/ To be Continued…

While this issue contained what I would call platforms and interactive learning tools, there are many more resources in video and text format that I want to include. So, in the next issue, we'll go over the top-rated application frameworks and my favorite free resources to look at each. To be continued!