SEC11-BP01 Train for application security
Provide training to your team on secure development and operation practices, which helps them build secure and high-quality software. This practice helps your team to prevent, detect, and remediate security issues earlier in the development lifecycle. Consider training that covers threat modeling, secure coding practices, and using services for secure configurations and operations. Provide your team access to training through self-service resources, and regularly gather their feedback for continuous improvement.
Desired outcome: You equip your team with the knowledge and skills necessary to design and build software with security in mind from the outset. Through training on threat modeling and secure development practices, your team has a deep understanding of potential security risks and how to mitigate them during the software development lifecycle (SDLC). This proactive approach to security is part of your team's culture, and you become able to identify and remediate potential security issues early on. As a result, your team delivers high-quality, secure software and features more efficiently, which accelerates the overall delivery timeline. You have a collaborative and inclusive security culture within your organization, where the ownership of security is shared across all builders.
Common anti-patterns:
-
You wait until a security review, and then consider the security properties of a system.
-
You leave all security decisions to a central security team.
-
You don't communicate how the decisions taken in the SDLC relate to the overall security expectations or policies of the organization.
-
You perform the security review process too late.
Benefits of establishing this best practice:
-
Better knowledge of the organizational requirements for security early in the development cycle.
-
Being able to identify and remediate potential security issues faster, resulting in a quicker delivery of features.
-
Improved quality of software and systems.
Level of risk exposed if this best practice is not established: Medium
Implementation guidance
To build secure and high-quality software, provide training to your team on common practices for secure development and operation of applications. This practice can help your team prevent, detect, and remediate security issues earlier in the development lifecycle, which can accelerate your delivery timeline.
To achieve this practice, consider training your team on threat
modeling using AWS resources like the
Threat
Modeling Workshop
Clearly define and communicate your organization's security review
process, and outline the responsibilities of your team, the
security team, and other stakeholders. Publish self-service
guidance, code examples, and templates that demonstrate how to
meet your security requirements. You can use AWS services like
AWS CloudFormation
Regularly gather feedback from your team on their experience with the security review process and training, and use this feedback to continuously improve. Conduct game days or bug bash campaigns to identify and address security issues while simultaneously enhancing your team's skills.
Implementation steps
-
Identify training needs: Assess the current skill level and knowledge gaps within your team regarding secure development practices through surveys, code reviews, or discussions with team members.
-
Plan the training: Based on the identified needs, create a training plan that covers relevant topics such as threat modeling, secure coding practices, security testing, and secure deployment practices. Employ resources like the Threat Modeling Workshop
, AWS Training and Certification , and industry or AWS Partner training programs. -
Schedule and deliver training: Schedule regular training sessions or workshops for your team. These can be instructor-led or self-paced, depending on your team's preferences and availability. Encourage hands-on exercises and practical examples to reinforce the learning.
-
Define a security review process: Collaborate with your security team and other stakeholders to clearly define the security review process for your applications. Document the responsibilities of each team or individual involved in the process, including your development team, security team, and other relevant stakeholders.
-
Create self-service resources: Develop self-service guidance, code examples, and templates that demonstrate how to meet your organization's security requirements. Consider AWS services like CloudFormation
, AWS CDK Constructs, and Service Catalog to provide pre-approved, secure configurations and reduce the need for custom setups. -
Communicate and socialize: Effectively communicate the security review process and the available self-service resources to your team. Conduct training sessions or workshops to familiarize them with these resources, and verify that they understand how to use them.
-
Gather feedback and improve: Regularly collect feedback from your team on their experience with the security review process and training. Use this feedback to identify areas for improvement and continuously refine the training materials, self-service resources, and the security review process.
-
Conduct security exercises: Organize game days or bug bash campaigns to identify and address security issues within your applications. These exercises not only help uncover potential vulnerabilities but also serve as practical learning opportunities for your team that enhance their skills in secure development and operation.
-
Continue to learn and improve: Encourage your team to stay up to date with the latest secure development practices, tools, and techniques. Regularly review and update your training materials and resources to reflect the evolving security landscape and best practices.
Resources
Related best practices:
Related documents:
Related videos:
Related examples:
Related services:
