In this engaging discussion, Tanya Janca, Head of Community at Semgrep and security trainer at She Hacks Purple, shares insights from her new book aimed at helping developers write secure code. She emphasizes the critical importance of validating inputs and adopting a zero-trust security model. Tanya discusses balancing security with usability, especially in sensitive environments like hospitals. She also explores effective strategies for securing legacy applications and the need for continuous security testing in the software development lifecycle.
Tanya Janca emphasizes the importance of educating developers on secure coding practices to foster a healthier security culture in software development.
The podcast discusses the zero trust security model, highlighting its role in continuously validating system connections to mitigate vulnerabilities.
Deep dives
Focus on Secure Coding for Developers
The new book by Tanya Janka aims to educate software developers on secure coding practices, diverging from her previous work tailored for security professionals. It emphasizes the need for developers to understand the intricacies of secure application development while providing practical examples and code-centric advice. By centering on coding practices, the book aims to foster a healthier security culture within the development community. Janka stresses that targeting developers is crucial since they are the primary creators of software and play a key role in addressing security vulnerabilities.
Effective Defenses Against Vulnerabilities
Janka suggests that instead of focusing on individual vulnerabilities, developers should prioritize implementing a comprehensive list of defenses that protect against multiple threats. She identifies 46 primary defenses that, if properly employed, can safeguard against a wide variety of vulnerabilities like injection attacks and cross-site scripting. This approach simplifies the security learning curve for developers, allowing them to concentrate on essential practices without getting overwhelmed by the vast array of potential threats. The conversation fosters the notion that security should be intrinsic to the developmental process rather than an afterthought.
Understanding Zero Trust Principles
The podcast discusses the zero trust security model, which advocates for continuous validation of all connections within a system. Janka explains that under this model, no part of the system should trust another by default; instead, they should only communicate if there's a clear business need. This principle addresses the risks associated with assumed trust, especially in large systems with multiple layers. Effective implementation of zero trust helps mitigate vulnerabilities that can arise when one unauthorized access point is overlooked in the larger security framework.
Challenges with the Software Supply Chain
Janka highlights the growing concern over software supply chain attacks, emphasizing the importance of securing every component used in application development. Many attackers target vulnerabilities within libraries or components that might be widely known, reflecting how critical it is to maintain rigorous checks on the code and dependencies integrated into projects. The discussion illustrates real-life scenarios of lax controls leading to unfettered access and costly mistakes in code management. It underlines the necessity for organizations to prioritize protection measures in their continuous integration and delivery processes to avoid such risks.
Tanya Janca talks about her new book and how to write secure code.
Details
Tanya's new book, why she is writing for the developer. Including code for multiple languages. What makes her book different. Starting with how to defend against vulnerabilities. Validation and sanitization. What zero trust is. Balancing too much security vs other needs. Supply chain attacks and accidents. Backing up and losing code. Excess security and workarounds. Sharing information about security breaches, making it ok to fail. Re-running security tests when code changes, using analysis tools. Testing legacy applications with compromised libraries, network segmentation, web application firewall. Where to get the book.