Developer security advocate Secure Code Warrior (SCW) has launched what it claims is the industry’s first benchmark designed to quantify the security competence of its customers’ software developer teams.
Although other security benchmark and scoring services exist, the SCW Trust Score is specifically designed to provide a baseline of the impact of organisations’ learning programmes, assess their effectiveness, and enable security, developer and engineering teams to better collaborate and recalibrate skills training.
Speaking to Computer Weekly, SCW chief technology officer, director and co-founder Matias Madou argued that educating and training developers earlier in the process was key to improving the overall security of the code they produce.
“What we identified 10 years ago is that a lot of organisations are late in the cycle – so instead of this whole shift left movement, we actually say start left,” he said. “If you do not educate the developer, if you do not start with developers that know their stuff, you’re not going to fix anything. You can throw whatever tools you like at the problem, but you’re not going to fix it.
“There’s a lot of tooling out there, but nothing really focuses on the person, the developer, the skills level, and that’s what we want to focus on.”
SCW believes the need for such a service is becoming more acute as demand for faster application development and integration of artificial intelligence capabilities combine to introduce the potential for more vulnerabilities to sneak in during the development process.
There is also a growing wave of awareness of these issues in the wake of several significant security failures, generally affecting the open source software community, that in some cases have led to major international cyber incidents.
SCW said these pressures mean organisations need to do more to create and maintain a security-conscious security team that is still able to perform at the top level – hence the creation of a benchmark to define the bell curve of their security programmes and understand the skills base of their developer teams.
To be demoed next week at the upcoming RSA Conference in the US, the SCW Trust Score is based on 20 million data points drawn from 250,000 learners at over 500 existing customers.
“A year ago, we asked a group of data scientists to look into our data and figure out what a good developer looks like,” said Madou. “They spent a lot of time coming up with an algorithm to aggregate all the skill levels of developers in an organisation, and we call that the Trust Score.
“We can now give a Trust Score to an organisation that is essentially an aggregate of all the learners’ skill levels,” he said. “It’s a number between zero and 1,000, and most companies right now are between 300 and 500.”
Madou said this score will enable organisations to measure how well their developers are writing secure code, and to compare themselves against various benchmarks – at launch, the service includes a global benchmark comparing all users, and two vertical-specific benchmarks for the technology and financial services industries.
Beyond this, SCW hopes the Trust Score will help IT and security leaders raise the bar for secure coding in their organisations, and funnel the best-performing developers into projects that need the most attention.
Individual developers
There is also a use case for individual developers. “We hope that the developers will really embrace that, and hopefully it will give them bragging rights on LinkedIn,” said Madou. “For example, they can say, ‘Hey, you know what, that’s how good I am’.
“If you’re a financial institution, you want to hire security-skilled developers, so we definitely hope that developers will embrace that,” he said.
Tests among beta customers have proved encouraging, with some reporting a 53% reduction in vulnerability volumes, and slashing the time it takes to fix critical ones. Madou said there is already plenty of evidence that the Trust Score has grabbed the attention of management, spurred engagement among customers and pushed them to upskill their developer teams.
Ultimately, SCW hopes the Trust Score will help push the developer community towards something of an industry standard.
“That’s certainly what we’re aiming for,” he said. “And I think we have a good shot at that. We have a lot of high-profile financial institutions benchmarked, and some high-profile technology companies, so there’s weight behind the Trust Score.”