More dedicated cybersecurity training in developer education is necessary to combat software vulnerabilities across the tech ecosystem, according to a new report from the Open Source Security Foundation.
“Time and again we’ve seen the exploitation of software vulnerabilities lead to catastrophic consequences, highlighting the critical need for developers at all levels to be armed with adequate knowledge and skills to write secure code,” David Wheeler, director of open source supply chain security for the Linux Foundation, said in a Tuesday release announcing the report.
OpenSSF is a project run by the Linux Foundation and includes organizations from the private sector, academia and nonprofits working to enhance the security of the open source ecosystem.
Wheeler said, “Our research found that a key challenge is the lack of education in secure software development. Practitioners are unsure where to start and instead are learning as they go. It is clear that an industry-wide effort to bring secure development education to the forefront must be a priority.”
The new report analyzes data from nearly 400 “professionals involved with software development” who filled out a survey online.
OpenSSF launched the survey in March with a focus on investigating how to better equip developers to create and maintain secure software.
The report identifies a major shortcoming in developer awareness of secure development practices. It says, “28% of professionals directly involved in software development are not familiar with secure software development.”
Half of tech professionals surveyed “identify a lack of training as a major challenge” when it comes security education, according to OpenSSF. The report notes this issue is “particularly pronounced among data science roles,” with 73 percent of data scientists acknowledging the challenge.
The report identifies “[s]elf-study” and “on-the-job-experience” as the most common ways professionals involved in software development gain knowledge about security considerations.
Respondents identified self-study as a “primary” resource for cybersecurity education at a rate of 74 percent, according to the report, including online tutorials, videos and books.
Meanwhile, 69 percent of respondents also “rely on on-the-job experience as a learning resource for secure software development,” the report says, “but it can take more than 5 years of such experience to achieve familiarity.”
OpenSSF has argued for the government to play a role in making security a larger focus of software developer education. OpenSSF submitted comments in November 2023 to the Office of the National Cyber Director on a request for information to further the government’s work on open source software.
The ONCD RFI asked for input on next steps for the interagency Open Source Software Security Initiative, which was established following the discovery of the Log4j vulnerability. The RFI offered five potential focus areas and asked stakeholders to weigh in on which topics should be prioritized.
OpenSSF told ONCD the federal government should engage with “post-secondary education, current software engineers and primary and secondary students” to boost the capabilities of the future developer workforce.
Looking ahead, OpenSSF is making its own commitments to create new educational resources.
“The first step in addressing secure software development is recognizing the existing knowledge gap and identifying priority areas for creating additional training,” said Intel’s Christopher Robinson, who co-chairs the OpenSSF Education Special Interest Group and chairs OpenSSF’s Technical Advisory Council.
Robinson said, “Based on these findings, OpenSSF will create a new course on security architecture which will be available later this year which will help promote a ’security by design’ approach to software developer education.”
The report also identifies supply chain security and emerging technologies as areas in need of future work. It says, “56% of respondents see supply chain security as a crucial area needing increased focus and innovation,” and “57% of respondents identify AI and ML security as a critical area for future innovation and attention in secure software development.” -- Jacob Livesay (jlivesay@iwpnews.com)