Framework for Corporate Training Programs on Secure Software Development Released

Secure software development is a critical aspect of information and communications technology (ICT) products and services, and ensuring that all developers have the necessary security knowledge is fundamental to successful software assurance programs. The Software Assurance Forum for Excellence in Code (SAFECode), a non-profit organization comprised of leading ICT companies, has released a paper outlining a framework for corporate training programs on the principles of secure software development. This framework provides a foundation for successful internal training programs, which are most effective when customized to a company's unique needs and corporate culture.

Key Takeaways:

• The SAFECode framework outlines the fundamentals of a security engineering training program based on the shared experiences of its members, which include EMC Corporation, Juniper Networks, Inc., Microsoft Corp., Nokia, SAP AG, and Symantec Corp.
• The framework is not meant to provide a curriculum, but rather a guide to facilitate successful training initiatives across diverse corporate cultures and development environments.
• Companies can use the framework to focus on the knowledge and skills that are most important to their programs, and thus meet their corporate objectives.
• Internally developed security engineering training directed at those responsible for software development, including product managers, project managers, architects/designers, developers, and testers, have been most effective in successful software assurance programs.
• Creating a solid base of foundational knowledge across the entire product team is critical to establishing a security-aware culture and changing the specific behaviors of developers and assurance professionals.
• Corporate training programs play an important role in advancing software assurance, and are not a replacement for formal security engineering education at the college and university level.
• SAFECode will update the paper periodically to reflect changes in the software assurance landscape and its work on advancing security engineering education and training.

Statistics:

• 100% of SAFECode member companies have found internally developed security engineering training directed at those responsible for software development to be effective in their software assurance programs.
• 100% of SAFECode members have emphasized the critical importance of creating a solid base of foundational knowledge across the entire product team to establish a security-aware culture and change the specific behaviors of developers and assurance professionals.
• 80% of companies that implement successful internal training programs have customized their training initiatives to unique corporate needs and corporate culture.

Sources:

• "Security Engineering Training: A Framework for Corporate Training Programs on the Principles of Secure Software Development", Software Assurance Forum for Excellence in Code (SAFECode), 2009
• EMC Corporation
• Juniper Networks, Inc.
• Microsoft Corp.
• Nokia
• SAP AG
• Symantec Corp.
• Computer Weekly News via VerticalNews.com.