With the industry full of examples of security vulnerabilities both in commercially off-the-shelf (COTS) products and software developed in-house, security education is critical for today’s enterprise.
Having your personnel “securitrained” — that is, made aware, skilled and certified in information security areas — is essential for designing, developing and deploying secure hack-resilient software.
Chinese war strategist Sun Tzu once said that knowing your enemy but not knowing yourself will lead you to defeat every time. To put it another way, awareness is the first step in security education: awareness of product, process and personnel.
First, IT pros should be aware not only of the security features of the product, but also of the implementation of those features. Merely having secure features in a product does not constitute a secure product.
Awareness of processes also is important. My previous article, “Software Without Seat Belts,” alludes to some of these process-centric tasks, covering security processes in the Systems Development Life Cycle (SDLC) that are necessary for building secure software.
In addition to product and process awareness, personnel awareness is important. Employees should be aware of the consequences of breaches in software security — including data disclosures; denial of service; legal, privacy and regulatory oversight; loss of competitive advantage; and/or irreparable reputational damages — so that such detrimental outcomes can be avoided.
The next stage in security education is to get your people skilled in information security. As Queen Elizabeth II once said, “You can…
Please log in or subscribe to read this article