Critical Security Trends in Software Development
In 2018 and 2019, it was difficult to convince enterprises of the need to migrate to cloud technologies. Many companies were simply not ready for such a large-scale shift; they were uncomfortable relying on cloud services instead of localized hardware and software.
But the situation changed. In 2020 and 2021, cloud migration became a primary focus, mainly due to the sudden onset of the pandemic. Companies chose one of the giant cloud providers, namely Amazon Web Services (AWS), Microsoft Azure, and/or Google Cloud, as these three companies control most of the cloud services market.
Currently, cloud computing enjoys incredible success, so much so that in 2024, global spending on cloud services will exceed $84 billion. However, IT experts warn that a new disruption is on the horizon. The widespread use of APIs, a shortage of IT professionals, and trust-but-verify software architecture create security challenges in the near future.
The exponential growth in cloud computing usage means the software development community must respond promptly to increasing security requirements. New cyber threats emerge daily, but developers use the same protection technologies as 3-10 years ago. In 2024, companies should take steps to incorporate these critical security trends into the development lifecycle and across all their software.
Key Critical Security Trends
Assessing IT Department Performance
IT security professionals are in short supply, and attackers significantly outnumber them. Most company executives do not understand the complex issues IT specialists have to deal with. Management should strive to inform themselves about these critical security issues and collaborate more closely with IT experts.
Furthermore, it should be noted that software development and cybersecurity largely overlap. Hiring third-party contractors is too common a practice resulting from this misunderstanding. In reality, creating high-quality software requires considering cybersecurity aspects. A more efficient use of the development budget would be to outsource the software development itself, not the cybersecurity department.
Additionally, it is worth noting that higher education institutions are adapting to the needs of an interconnected world by creating more programs for cybersecurity and IT professionals. Despite this, the gap between supply and demand for skilled cybersecurity professionals is likely to persist. Currently, there are many entry-level workers, but a severe shortage of IT specialists with 10-15 years of experience.
API
The interconnectedness of APIs (Application Programming Interface) may not be obvious to those not involved in software and web application development. But in this field, APIs connect everything. However, they are particularly difficult to secure because they are hard to access.
Developers constantly use APIs, which sometimes means your engineers may use APIs developed by someone else. By using external APIs, companies open themselves up to catastrophic security risks.
A great example of this is Cambridge Analytica. Although this PR disaster was technically not a data security breach, Facebook's APIs were at the center of the scandal.
Facebook failed to establish important permission frameworks, comply with terms of service, and notify users about how their data was being collected and used. Without going into details, Cambridge Analytica was able to use Facebook's Graph API to collect and sell data on over 87 million users.
Other API security risks include incorrect security configuration, unnecessary data exposure, poor monitoring, inadequate logging, and permission and authorization issues. When transferring data between different software environments, there is a high risk of malicious manipulation or collection. At a minimum, all APIs that transmit user data require data encryption and integration with OAuth.
Software Bill of Materials (SBOM)
In development, it is rare to achieve 100% original and non-interconnected software. Code reuse is extremely common because it allows teams to develop complex software within reasonable timeframes. Code reuse increases efficiency and productivity, but if the source code was low quality, unreliable, or insecure, these issues will propagate throughout the platform.
Within a single software product, companies may incorporate many smaller software products, microcode, and APIs. A security breach during financial transactions or when handling sensitive user data can be catastrophic.
It is important to note that the U.S. government may soon require an SBOM for all software products used by government agencies. An SBOM is a software bill of materials, in which the company must list all components that make up the software. These components include items such as APIs, software, and microcode.
Government bodies will be able to review software based on the SBOM and determine whether it is sufficiently reliable and secure for government use. This approach seems like a good measure, so it may also be adopted in the private sector.
Zero Trust and Access Control
Information security professionals use the zero trust concept to protect IT resources. Zero trust architecture treats everyone interacting with software or data as suspect. No one has access rights to areas not specified in permissions.
After implementing a zero trust system, every user action to access or modify data requires identity verification. This architecture eliminates the 'blind spots' inherent in perimeter-based security. Attacks from outside the firewall are not the only way to penetrate protected networks. Companies must understand that attacks often come from inside, through user access.
Defining specific permission levels for each user group is the beginning of the journey toward a zero trust policy. Software development requires different access than administration or project management. The company's unique hierarchy defines these rules, but users should have only the minimum privileges necessary to perform their jobs. All companies need a process for removing access for employees who have left the company.
The 'trust but verify' principle has become common practice, but companies must invest in more effective security monitoring and anticipate threats from all sides. Zero trust provides the most robust protection against threats by requiring multi-factor authentication for every new session.
Focus on One Area of Improvement at a Time
Each company has its own cybersecurity needs. When developing software involving financial transactions and user data storage, principles of good faith development must be followed. Developers and product managers should consult with IT professionals when working on every new feature. In this context, effective communication tools are important for building close relationships with the IT department, especially if it is a third-party organization.
To avoid problems, companies should have security specialists review APIs for issues and fix them immediately. If software adds value and integrates into the user's life, it almost certainly uses APIs. These systems should be restructured as necessary to avoid ending up in a situation like Facebook.
Companies operating in industries where federal and state contracts are common should consider including SBOMs in all products under development. All companies should move from a 'trust but verify' security architecture to a zero trust security architecture. Developers, end users, and everyone in between should have clearly defined minimal access requirements. Zero trust is already a standard in many industries, and its adoption will grow rapidly.