Secure Code Warrior (SCW) today added an agent to its portfolio of application security that assesses the security competency of developers as they commit code to a repository.
The SCW Trust Agent is based on an ability to score the security expertise of developers that SCW rolled out earlier this year.
The SCW Trust Agent can be deployed on any Git-based code repository, including Github, Gitlab and Atlassian Bitbucket to ensure that only developers that have only developers that have attained a specific security rating are allowed to make a commit. Those ratings are based on more than 20 million data points collected from 250,000 developers around the world.
Depending on the criticality of the project, DevSecOps teams can customize policy configuration based on the level of risk each application project represents.
SCW CTO Matias Madou said the overall goal is to not only make code bases more secure but also make it simpler for organizations to identify which application developers require additional security training.
In addition, restricting which members of an application development team are actually allowed to make a commit also helps to streamline any audit that might be conducted at a later date.
Ensuring the security of software supply chains requires not only providing developers with the best tools possible but also locking down processes. In the race to build applications faster, many organizations have overlooked the need to make sure commits to repositories are first reviewed by experienced developers. That might not prevent every mistake made from making it into a repository, but it should at the very least reduce the frequency.
Arguably, one of the most exasperating issues that DevSecOps teams encounter is application developers keep making the same basic security mistake multiple times. The most common vulnerabilities found in code are pretty much the same for the past decade, noted Madou.
It’s not clear to what degree organizations will eventually be required to deploy applications that have fewer vulnerabilities. The European Union is forging ahead with a Cyber Resilience Act that requires organizations to build more secure software. However, a recent Chevron ruling by the U.S. Supreme Court has limited the authority under federal agencies and extended the charters under which they were created to enforce new regulations not specifically approved by the U.S. Congress. As such, it’s become less likely compliance requirements pertaining to software security are going to be enforced any time soon.
However, organizations are still likely to be held more liable by courts for deploying software that has known vulnerabilities. The only thing that will need to be determined in each case brought is the degree to which deploying software with known vulnerabilities is considered reckless by the court. The more reckless an act is the higher the penalties that are typically levied.
As a result, regardless of compliance regulations, organizations of all sizes now have a greater vested interest in making sure that as many known vulnerabilities as possible don’t find their way into production environments.
