For digital transformation to work, developers need to take security seriously

Security heads at GSK, M&S and Williams believe software engineers need a guiding hand

Graphic depicting a digital padlock on a colourful background

When it comes to innovation, many IT leaders are fond of the mantra 'move fast and break things'. However, if you're responsible for the integrity and availability of your organisation's IT systems, breaking things can have some pretty disastrous consequences.

So how do some of the tech industry's top security chiefs handle the problem of ensuring their companies can move at the necessary speed required to maintain a viable digital transformation initiative whilst also keeping everything as protected as possible?

For Marks & Spencer's head of information security, Lee Barney, the answer is in making sure that you're properly implementing DevOps practices and agile methodologies. The rest, he says, will follow naturally.

"We bake the responsibility for cybersecurity into the first line of defence," he explains. "Making sure the software engineers know exactly what they need to do to code securely, so they are as good as the red team [penetration testers probing the infrastructure for vulnerabilities], for example, in identifying unsecure code and avoiding that... that is the way to do it.

"If you've gone the whole hog with DevOps, that should be fine, because the people who are actually making the changes - not just the software engineers but the people who are responsible for making sure that particular product is up and running - they also know about security. They know enough security to know when they don't know enough, and they then come to you and ask for assistance."

John Meakin, CISO of GlaxoSmithKline, agrees that the key is in enabling developers and giving them a good toolkit for securing and testing their code. After all, he points out - they're the ones that are going to be responsible for actually delivering security, rather than the CISO.

"You basically let go and allow them to do the security - so long as you're there," he says. "You've got to be there and you've got to be confident in telling them when they're doing it wrong. Because you're there, you're [telling them] early enough that it makes a difference.

"If the design is fundamentally wrong, then you need to point that out; you need to point out the risk. Not say to them 'the design is wrong, this is how you design it'. You point out the risk, which leads them to the decision 'oh, the design was wrong, I need to design it a different way'."

For Graeme Hackland, CIO of Formula One team Williams, achieving 'security by design' in a DevOps environment is tricky if your development team hasn't specifically trained for it. If integrating security as a core part of the development process isn't a natural thing for them, developers will often see the addition of security as something which slows them down when they're on a tight deadline.

"We're getting to the point where you have to get to your developers a lot earlier and get them into that mindset and thinking fairly early in their career," he states. "So it's focusing on the human aspect from my point of view, and making sure that your coders and the testers who are sitting right next to them are in that mindset just without even having to think about it - it's just part of who they are."

However, Meakin also warns that developers need to meet security personnel halfway. While he noted that the culture of a developer community isn't going to change overnight, he stressed the importance of developers evolving and engaging with security on a deeper level.

Thankfully, he sees a new breed of developers and development managers entering the industry who do truly understand the value of security and are happy to work with security teams as a core part of the development process.

"One of the great things within GSK is that there's been a recognition that not only does security need to adapt its approach but the developer community themselves need to adapt their mindset," Meakin says.

"What we're finding is that as we look out at the developer community as part of a natural refresh, we're finding a generation of developers - including development managers - who really get security. They don't know all the techie details we do... but they get security and they're prepared to give security almost equal weighting with business function points."

Picture: Shutterstock

Featured Resources

Choosing a collaboration platform

Eight questions every IT leader should ask

Download now

Performance benchmark: PostgreSQL/ MongoDB

Helping developers choose a database

Download now

Customer service vs. customer experience

Three-step guide to modern customer experience

Download now

Taking a proactive approach to cyber security

A complete guide to penetration testing

Download now

Recommended

HackBoss malware is using Telegram to steal cryptocurrency from other hackers
cryptocurrencies

HackBoss malware is using Telegram to steal cryptocurrency from other hackers

16 Apr 2021
Geico data breach leads to stolen driver’s license numbers
data breaches

Geico data breach leads to stolen driver’s license numbers

21 Apr 2021
UK’s IoT security regulation will also include smartphones
Internet of Things (IoT)

UK’s IoT security regulation will also include smartphones

21 Apr 2021
eBay, Apple, Microsoft, Facebook, and Google were phishers’ top targets in 2020
phishing

eBay, Apple, Microsoft, Facebook, and Google were phishers’ top targets in 2020

20 Apr 2021

Most Popular

Microsoft is submerging servers in boiling liquid to prevent Teams outages
data centres

Microsoft is submerging servers in boiling liquid to prevent Teams outages

7 Apr 2021
How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

8 Apr 2021
REvil threatens to release Apple’s hardware schematics
ransomware

REvil threatens to release Apple’s hardware schematics

21 Apr 2021