Create security culture to boost cyber defences, says Troy Hunt

Creating a security culture can ease tensions between developers and security professionals and raise an organisation’s cyber defence capability, according to Troy Hunt, Pluralsight author and security expert.

“Security must be top of mind for all technology professionals in an organisation, not just the designated security team,” he told Computer Weekly.

“With a new hack or breach happening almost daily, organisations must develop the skills required to safeguard and manage against security threats by making security the norm rather than the exception.”

But organisations typically struggle to make cyber security front of mind for everyone so that it is becomes a pervasive organisational behaviour, said Hunt.

“Even organisations that are security aware enough to be training employees on various related topics do not necessarily know how to make those hard skills part of the organisation’s culture,” he said.

This realisation, he said, led to the development of a course on creating a security-centric culture for Pluralsight, an enterprise technology learning platform company.

The course is aimed at helping technology professionals and management understand how to embed a culture of security in their organisations, said Hunt.

Part of the problem, he said, is that many organisations’ development and security teams tend to work in separate silos.

Typically, development groups build the software before it is passed to the security team, but this creates a divide between these groups.

Developers tend to be scared of the security people, said Hunt, because the security people can stop software projects from going live if any critical security vulnerabilities are identified in the software code.  

“As a result, there is often tension between these two groups,” he said. “I do about 20 workshops a year at banks, e-commerce companies and the like, and I see this friction over and over again.”

The first thing to bear in mind when it comes to security training is the audience, said Hunt. “Often security teams do the training, but use terms and tools that are unfamiliar to developers,” he said.

“So key to creating a security-centric culture is ensuring these groups work together, and also understanding that developers and IT pros work in a different way to security pros.”

Another important thing to note is that developers often do not understand why they are writing code resilient to SQL injection, for example, said Hunt.

“Often, they haven’t seen it go wrong. But when they see something like sqlmap [a SQL injection and database takeover tool] pointed at their application and all the data ripped out of the system, then they go ‘OK, I see the problem. Maybe we should change the way we write code’. So showing and not just telling is really important,” he said.

Another useful way to move organisations, and the individuals within them, away from a hypothetical approach to security is to refer to industry precedents, said Hunt.

“Highlight what has happened to drive security thinking and approaches. For example, good security practice is to load login pages over HTTPS, and that is because Facebook was hit by man-in-the-middle attacks in 2011 by the Tunisian government,” he said.

“The government wanted to collect the logins of Facebook users, and because Facebook was loading logins over HTTP, the Tunisian government was able to use key loggers to syphon off credentials, and that is a really good precedent of why we need to follow best practice for login pages.”