One of the easiest ways to secure your company’s application is by applying security by design approach. Yet security by design is the latter option for most companies. Security and safety should not be seen as a latter option as this could lead to further problems in the future. This article will explore the security-by-design approach and why it might be able to save your company in the near future.
Security by design is a theory in an approach that prioritizes security first in an application so it would be safe from cyber threat actors’ malicious attacks. For example, developers might put the application release on a halt to add features that can prevent cyber attacks, or close some loose holes to prevent any data leakage.
But in this fast ever-changing world, developers might need to take advantage of this approach to accomplish a faster release date so their applications can compete with their rivals.
Is it wrong?
From a customer’s point of view, yes, as this approach can be dangerous for customers’ data and safety. But from a company’s point of view, this will be in a gray area, as profit is the main source of the company’s heartbeat.
Quoted from an article by Darkreading in 2022, only 14% of developers acknowledge the importance of application security and put it as their priority when coding. That percentage is less than 20%.
However that survey should not be taken as a sign of hopelessness in the world of cyber security. Rather as something that should be a topic of discussion. A discussion should be done by all parties involved. Is it the lack of time? The need to push things faster? The company’s ego to compete? Or what? A solution is needed so the safety of customers would not be sacrificed.
Can AI fix this issue?
If time is the problem, should a company deploy AI to code instead of using humans? The answer is an absolute no. Companies should not replace humans for the sake of speed. While AI seems like a faster and cheaper option, AI cannot replace what humans can do.
Jared Toporek, a consultant who wrote in the Stack Overflow said this:
Software is rarely done; features get added and bugs are fixed; it’s an ongoing exercise. Unlike software, once a chess game is won or lost, it’s over.
Toporek stated that programmers should not be worried about the possibility of AI replacing them. Creating software is just not about coding, but it is about listening to your customers and knowing what to do by being versatile. Software is not about finished or unfinished, it is about keeping it alive.
Tight deadline.
BlueOptima wrote that tight deadlines or development crunch have been normalized in the software development industry. There are various reasons that lead to this normalization, but one of them is the client request or the business expectations.
The tight deadline for software developers is the cause of many unwanted things, such as employee burnout, unfinished software that is shipped with bugs with security vulnerabilities, and other problems. Those who hold power should be the ones to take accountability and change the culture in the industry.
Accountability can be started by recruiting more people, and not letting one person work on many different developing projects. Companies should also prioritize transparency to their customers, by letting them know the reasons for delay or other things.
Security by design & security by accident
Contradictory to security by design, security by accident is the act of enhancing cyber security after an incident happens. This is not a good practice because it requires the attack to take place. A company needs to be ready for this and act quickly and wisely.
Coding with securing coding or a security-by-design approach is a better choice in every case. Though security by design might take a longer development cycle, and perhaps cost, it is wiser to enhance the security before anything happens.
Read our other works:
• Indonesia Upcoming 2024 Election Cyber Problems
• What is Printer Hacking? Get to Know Printer Hacking and How to Protect Your Company
• Accessibility Against Cyber Security
Reference:
- https://securityintelligence.com/articles/secure-by-design-which-comes-first-code-or-securitry/
- https://www.darkreading.com/application-security/developers-increasingly-prioritize-secure-coding
- https://stackoverflow.blog/2023/12/29/the-hardest-part-of-building-software-is-not-coding-its-requirements/
- https://www.blueoptima.com/software-development-crunch-the-impact-on-developers/