I work in the infosec field and I think it is unfair to blame the whole industry. I think the whole technology field is to blame here (although I really don't like to play the blame game). By the way, I have been around the security industry for around 10 years, and the same exact conversation has been going on. 10 years ago it was the Web, then around 7 years ago it was Mobile, now it is IOT, several years from now, we are going to have the same conversation regarding a different technology unless we do something regarding the root causes.
The root causes are the following:
1- Security more often than not is an afterthought. When you are trying to go to market, under tight deadlines, burning the night oil, nobody has time, energy or money to think about security.
2- The lack of security education by most of the stakeholders (upper management, product managers, engineers, etc) does not help and keep security a taboo, in most organization, nobody has the title of making the software secure. So it falls into nobody's lap
3- While, I have all the respect to the profession of honest sales, some salesmen ruined it for all of us, feasting on the lack of education mentioned above. Trying to sell tools/services as the silver bullet to the security problem, an idea that is very well received by someone who does not understand the problem and really looking for a silver bullet
4- At the end of the day, the real issue is that security is a cost center, there is no ROI for the business for doing security other than avoiding problems that "could" happen in the future.
That being said, there are three classes for clients I have seen doing security:
1- Heavy losses: for banks for example, the risk of losing money is quiet real and tangible. Besides they (at least in the U.S) under heavy regulations to do so. But their real motivation is risk mitigation.
2- Regulations (worst reason to do security): such as the PCI industry, they have to do security checks to avoid fines. This category usually try to do the minimum to get by.
3- Proactiveness: hats off to this category, as they don't really have to do it other than they think that this is something that must be done.
Solutions:
1- More education
2- More education
3- More education
4- Implement more security controls natively into frameworks (output encoding, entity frameworks, etc) and browsers (such as CSP policy, etc)
5- More fines for companies that don't really take the minimum amount of steps to ensure data confidentiality and integrity.
Software Secured (www.softwarescured.com) launched the Open-Source Security Project (https://ossp.softwaresecured.com) a project aimed at providing vulnerability sweeps to as many open-source projects as possible. Rules are simple, submit a project, the project with the most votes will be reviewed.
Are you looking to break into the application security field?
You are a great software developer who has 2-5 years of experience in at least two of the following programming languages: Java, .NET, JavaScript, C/C++ and/or Ruby.
You don’t work on a piece of code until you know how it works first, you are not afraid to dig into code even if it wasn’t yours. You like to know how things work under the hood but uncertainty does not stop you either. Failing is not an option, you just have to try again smarter AND harder.
You have a very strong background in application security; you know what OWASP Top 10 is inside out, and tinkered before with several online capture-the-flags.
You are very happy writing code but somehow application security, breaking software, finding vulnerabilities, and going beyond just writing code are some of the things that you just can’t take off your mind.
Hacking news and stolen data makes you upset. You are curious, analytical, smart, ambitious and crafty with unlimited desire to learn and grow.
If the above describes you, then this is your chance.
This entry level application security opportunity will let you continue writing code as well as do application security work such as security code reviews, web and mobile application penetration testing (extensive training will be provided).
If you are interested; please send your resume to [email protected] and a cover letter that explains why you think you are the perfect fit for this job.
The root causes are the following: 1- Security more often than not is an afterthought. When you are trying to go to market, under tight deadlines, burning the night oil, nobody has time, energy or money to think about security. 2- The lack of security education by most of the stakeholders (upper management, product managers, engineers, etc) does not help and keep security a taboo, in most organization, nobody has the title of making the software secure. So it falls into nobody's lap 3- While, I have all the respect to the profession of honest sales, some salesmen ruined it for all of us, feasting on the lack of education mentioned above. Trying to sell tools/services as the silver bullet to the security problem, an idea that is very well received by someone who does not understand the problem and really looking for a silver bullet 4- At the end of the day, the real issue is that security is a cost center, there is no ROI for the business for doing security other than avoiding problems that "could" happen in the future.
That being said, there are three classes for clients I have seen doing security: 1- Heavy losses: for banks for example, the risk of losing money is quiet real and tangible. Besides they (at least in the U.S) under heavy regulations to do so. But their real motivation is risk mitigation. 2- Regulations (worst reason to do security): such as the PCI industry, they have to do security checks to avoid fines. This category usually try to do the minimum to get by. 3- Proactiveness: hats off to this category, as they don't really have to do it other than they think that this is something that must be done.
Solutions: 1- More education 2- More education 3- More education 4- Implement more security controls natively into frameworks (output encoding, entity frameworks, etc) and browsers (such as CSP policy, etc) 5- More fines for companies that don't really take the minimum amount of steps to ensure data confidentiality and integrity.