Hire Robots | Application Security Tips
Life of a software engineer can be challenging. You need to research and find the right solutions. The code you write must be readable, maintainable, and if possible reusable. You need to remember about performance and accessibility. That’s a lot. And then and the end it would be perfect if you wrote secure code. On the other hand, you need to deliver in a timely manner, fix bugs and mentor others. No wonder why it’s easy to get overwhelmed and frustrated.
In an environment like that (dynamic and embracing changes as they put it in job postings), security can seem like a burden, blocker, stinky egg. Security is important but we don;t have time to do it, I often hear and understand it completely. In my opinion, expecting a developer to take care of everything is unfair. This could be a post about engineering values but I’ll skip it for now because I’d like to encourage you to delegate.
Delegate your security
There are solutions that can help you find vulnerabilities in your applications. The most popular tools are called SAST and DAST.
SAST - Static application security testing (SAST) reviews the source code to identify vulnerabilities. It will tell you about credentials, SQL injections, Cross-Site Scripting and many many many more.
DAST - dynamic application security testing (DAST) is a program which communicates with your application through the front-end in order to identify potential security vulnerabilities and its architectural weaknesses.
A tool is not enough
Hiring robots won’t be possible without spending some money. However if you have a growing team, automating security will be a great investment. Customers do ask about these tools, and it may win them over.
Nice thing about these scanners is that you can integrate them into your pull request workflow so that your current branch is checked immediately. Of course, buying a new tool is pointless if no one uses them. Therefore you will train your teams to use them. Still, it can be a huge help for engineers and the security of your product.