How to turn developers into security champions

How can a security champion help?

The fact is, when it comes to DevOps, your security team can’t be everywhere at once – there are just not enough hours in the day or manpower to provide the security coverage your developers need. In addition, there’s a major security skills gap in the development industry, putting developers with adequate security experience in short supply. In fact, a recent Veracode/DevOps.com survey found that nearly 40 percent of the survey’s respondents said they struggle to find all-purpose DevOps gurus with sufficient knowledge of security testing. That’s not surprising considering that the survey also found that 76 percent of developer survey respondents who attended college reported that they weren’t required to complete any security courses while in school. And finally, when given the opportunity to add a team member, organizations often choose to add a developer who can produce product and profit over a security team member who can be seen as a cost.

With a security champion, an organization can make up for a lack of security coverage or skills by empowering a member of the development team to act as a force multiplier who can pass on security best practices, answer questions, and raise security awareness.

Because your security champion speaks the lingo of developers and is intimately involved in the project, he or she can communicate security issues in a way that the development team will understand and embrace. The best part? By increasing the security quality of code at the development stage, you’ll reduce bottlenecks at the security review stage, giving your security team more time to work on high-value tasks.