{"id":11189,"date":"2022-02-15T17:01:09","date_gmt":"2022-02-15T17:01:09","guid":{"rendered":"https:\/\/staging-site.42crunch.com\/?p=11189"},"modified":"2022-11-28T15:26:32","modified_gmt":"2022-11-28T15:26:32","slug":"how-developers-can-become-api-security-champions","status":"publish","type":"post","link":"https:\/\/staging2022.42crunch.com\/how-developers-can-become-api-security-champions\/","title":{"rendered":"How Developers Can Become API Security Champions"},"content":{"rendered":"

Question: Everyone is talking about DevSecOps, why are we not able to fix the security issues?<\/strong><\/h4>\n

Despite the obvious challenges, Colin believes that the industry has made progress as compared to ten years ago when very insecure code was prevalent. Today’s code is definitely more secure and security is improving \u2014 thankfully most developers are at least now aware of what an SQL injection attack is.\u00a0 Philippe also thinks things are improving, however, he sounds a note of caution, mindful of the ever increasing volume of APIs and related attacks he fears it is not obvious that the industry is keeping pace with these new targeted threats. The landscape has definitely become more complicated and things are moving fast. He notes that it is a challenge for developers to keep up with the security guidelines and ever changing threats.\u00a0\u00a0<\/span><\/p>\n

Question: How do we get developers engaged in API Security?<\/strong><\/h4>\n

Although developers can do a lot to educate themselves about API security, companies and security teams also need to make positive changes to their approach to get the best results and prevent security blockages, security issues and development delays. So Philippe answers this question by looking at each entity individually.<\/span><\/p>\n

What can an individual developer do?<\/strong><\/p>\n

Developers need to have a solid security awareness just like they know how to write code that performs well. They should push for security training to ensure they have the basic awareness of what it means to build secure software. While every developer does not need to be a security expert, they should realize that their actions may have security consequences and consequently need to know who to ask on the security team or who is the security champion on their team.\u00a0<\/span><\/p>\n

What can companies do?<\/strong><\/p>\n

Philippe advocates that companies must provide their developers with the resources to implement security. Sometimes companies are reluctant to invest enough as security is often perceived as an additional overhead, but the benefit of providing development teams with the correct tools, far outweighs the downside, and will save the company money and protect their reputation, and reduce the costs of breaches or expensive security updates.<\/span><\/p>\n

Companies should afford developers the following:<\/span><\/p>\n