What are some 'pitches' to management to overcome security training issues?

  • setup a security meetup, attrackt other developers and security specialist. Give away pizza, beer and mate. – cornelinux Feb 16 '17 at 18:48

Great question, and highly relevant!

First, recognize that training is only one facet of maintaining and building secure systems. Having the best app developers won't save you if an attacker enters through an unpatched server, or if your bookkeeper is hooked by a phishing email. Your organization should have a security policy that spells out a full plan; one aspect of the plan would likely be to provide developer training. This is where a CISSP could help you prepare yourselves.

That said, if you're in a regulated field (PCI DSS, HIPAA, GLBA, SOX, Healthcare, etc.) a security plan that features developer training is often a requirement to pass audit. That's probably the easiest sell, although it may only get you a bare minimum of training.

Have your systems been breached? You might be able to build a case that better software could helps prevent the next breach.

Look around your industry at similar solution providers: have they been breached? Do some research and show your management what it cost them when they were breached, and how a focus on security (not just training) might help you avoid becoming the next victim.

Could your customers using your systems be breached as a result of your negligence? A robust security policy is not cheap, but it is much cheaper than lawsuits.

Do you have a relationship with a tool vendor that might offer secure development training? I know Microsoft offers such courses; I expect others do too. Check with your compiler vendor, your static code analysis vendor, or other similar company. Pluralsight, Safari, Khan, and many other training companies have on-line training resources. There's probably a MOOC out there that would get you a proper security education for free.

Also, check with your government. They may have "cyber defense resources" available that could include training. In the USA, NIST has the National Initiative for Cybersecurity Education (NICE), which could help you jumpstart things.

Is there an OWASP chapter nearby? Attend a meeting. Perhaps networking with them could get you a consultant or instructor for a reasonable price. Also, there are many fine regional security conferences, and they're much cheaper than the big-name national and international conferences. If there's one near your city, your company won't even have to pay for hotel rooms. With nothing to give management but a guess, they're going to imagine that a security program would cost millions that they don't have. Having a cost estimate makes the discussion with management at least possible.

I'm guessing your organization doesn't have a budget for security at this time. Have you considered volunteering to be your organization's Security Champion? Even if you don't know everything about security policies and practices at this stage in your career, just getting people talking about security issues might spur management to act in the next budget year.

Not the answer you're looking for? Browse other questions tagged or ask your own question.