Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

We are a small company that is coming increasingly under pressure to be PCI complaint.

Our main product is an API that move cardholder data between a customer and a supplier. I am in the process of getting the company PCI DSS complaint.

The problem I have is that we do not want to spend loads of money on developer training. PCI DSS Recruitment 6.5: "Verify that processes require training in secure coding techniques for developers, based on industry best practices and guidance."

What is the most cost effective way to comply with this requirement?

share|improve this question
4  
I think you mean: "What is the cheapest way to ignore regulations and get hacked?" Developer mistakes is the source of the problem. – Rook Jul 31 '12 at 15:19
1  
The only way to ensure customer security is to attack the source of security vulnerabilities: development. Spend 90% of your security budget on training. The rest is incidental. – Polynomial Jul 31 '12 at 15:27
1  
@Polynomial I think you totally miss the point of the question. If I chuck 90% of the budget on developer training how will I pay for the independent audits? The scans? The policy development? and so on....Look, I am working for a small company on a tight budget. I think you will find in the current economic climate more and more folks will be looking to do things cost effectively. – Rup Jul 31 '12 at 15:36
3  
@Rup 90% was just a brainfart number, not something I was serious about. I'm emphasising that it's hugely important. Don't skimp on it. If you can't afford to certify as PCI-DSS, don't! Outsource your storage and payment processing to another company. It's a terrible security decision to cut corners. – Polynomial Jul 31 '12 at 15:38
6  
Everyone, please calm down, this is a very valid question. Let me give one example: Buying one of those extremely expensive 3 day courses for every developers as a one time event is likely not as effective as a long term strategy: It may consist of teaching one or two security experts, that do internal courses tailored to the architecture at hand for the other developers, code reviews and encourage discussions among developers about security related topics. – Hendrik Brummermann♦ Jul 31 '12 at 17:42
show 5 more comments

3 Answers

up vote 3 down vote accepted

Security behaves just like any other quality property:

If your software is unreliable and causes damage to your client, you may be sued for compensation of damages, and/or get bad press coverage. The exact same is true for security issues.

Just like other quality properties, using a huge amount of money for one time events, is not likely to have a lasting effect. Ensuring quality in the long run requires structures that support it.

To be more concrete: A one time 3 day general security training for all developers may be quite expensive, but is probably not an effective way to spend the money.

A long term approach may be this: Appoint a small number of security experts and educate them (for example by letting them visit courses, get external consultation, ...). This group will

  • identify the security aspects that are important for their fellow developers (e. g. a web application developer using Java should focus on OWASP instead of buffer overflows)
  • support the architecture development group to minimize the potential for security related mistakes
  • teach the fellow developers about security aspects based on the concrete architecture at use in their company
  • do code reviews
  • encourage discussions about security aspects.

Let me give an example: A company develops a web application using the component based Java Server Faces framework. In JSF, the userinterface components generate HTML and JavaScript code. So component developers need to be aware of XSS and escape all input.

Developers of business functions use these userinterface components. They don't need to write HTML code, so they don't need to escape input (and cannot because escaping is the task of the components). But business function developers need to understand how to use the components securely (e. g. don't generate HTML code themselves circumventing the components).

share|improve this answer
up vote 2 down vote

I disagree with the wording of several of the comments above, but not the sentiment. Developer coding mistakes are the source of most problems. With that said, even experienced security-minded developers fall down (otherwise we wouldn't have to patch MS operating systems every month, would we?)

(However, I also think the scope of the question is much too broad, and for that you will probably get it closed until it is edited to further fit the model here on Sec.SE.)

There are plenty of similar questions on the forum suggesting "best practices", top 10 lists (such as OWASP), etc. which can form the kernel of a focused, developer-minded training session. Your senior developers or development manager would be the right person to spearhead this. You may need to bring in outside help to create an appropriate training program. It can be done relatively cheaply depending on how independent your developers are. Most developers I know would relish being able to add more static skills and experience to their repertoire (languages and frameworks come and go, but security-minded-ness endures). You don't need to send them all on SANS course.

You might find that a "Train-the-trainer" (TTT) model works well for you. Hierarchical training is always cheaper than formally educating everyone.

However, I close saying that the sentiment in the comments is right. "Teach a man to fish..." and all that.

share|improve this answer
up vote 1 down vote

All you need to do is to actually go with SDL http://www.microsoft.com/security/sdl/default.aspx

Simply by integrating this process with dev team you are sorted.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.