“Security is a knock-out criterion for the acceptance of digital services that handle sensitive data. And as long as it’s treated half-heartedly, it won’t work.”
(Richard Seidl)
I’m sitting on flight UAL181 from Frankfurt to Denver, on my way to a retreat. And once again I’m reminded how much safety and security matter, and why software security awareness can’t stay with a handful of experts. All the way from the hotel to the parking garage, on to check-in and the security check, through passport and customs control, onto the plane and then the whole thing again in reverse, software captures, scans, tracks, manages, hands me on and moves me along. So yes, I’d really like nothing to happen to me AND my data to be safe. The airline industry has been at this for a long time. The processes are clear and have been tightened after various incidents. My trust in safety here is very high. Well, high.
I’m certainly no safety or security expert, but in my private life I try to use 2FA/MFA, different passwords, encryption for my data and so on. I’m also someone who sees software and technology as THE tool for building a good future worth living in. I want all my health, medication and patient data on a card, on my smartphone or in the cloud. I want to identify myself digitally, stop carrying keys around and handle all my dealings with government offices online.
BUT: it has to be secure. And when I look at the history of the electronic health card, at government and municipal online forms that look like the 90s, and at all the different offline payment options that sometimes work and sometimes don’t, my trust in security doesn’t go very far. My personal zero trust, so to speak.
Software Security Is a Knock-Out Criterion
For any digital service that handles sensitive data, security decides whether people accept it at all. Anything less than taking it seriously won’t cut it.
Fine, the stakeholders need to act. We need requirements for this! And security tests! But what else can we do?
Software Security Awareness for Everyone on the Project
I think it works the same way as with software quality in general: everyone involved in the project needs a basic understanding of security. We don’t all have to become top security specialists, but a certain level of knowledge helps throughout the entire development process.
Good literature on IT and software security is a solid place to start. So are training courses and certifications such as the A4Q Security Essentials certification, which sets out to give exactly this kind of entry point to everyone on a project.
Either way, what matters is that security knowledge doesn’t end up stuck on an island. Everyone on the project can keep security in mind, whether they’re testers, developers, project managers or the people writing the requirements. Then acceptance and user trust will follow. Probably not tomorrow or the day after. But maybe in a few months.
