SoftwareEngineering

When I started software engineering, Waterfall was the typical process. A team would spend months building a large feature set, then deploy it. There were lots of reasons for it. Hardware acquisition looked nothing like it does today. Deployments took hours, not minutes. There were far fewer frameworks and almost no standardized automation. It was costly to do individual releases and thus batching was preferred. The batching had a time cost, though. User feedback was slower, patches took longer, and project management was more complex. ...

Time for a New Year’s Resolution: Your Software Security KPI—A Perfectly Secure Product In The One Thing by Gary Keller and Jay Papasan, the authors explore how long-term goals function as behavior-change mechanisms. They advocate for SMART goals with very low odds of achievement—almost impossible targets. What Would That Goal Look Like for Software Security? Goal: Any security vulnerability finding in any environment by any scan or vendor will be remediated in 60 days. ...

Overview The article argues that traditional Application Security Key Performance Indicators (KPIs) often undermine program success and product delivery. As noted, “You can’t manage what you can’t measure,” yet choosing the wrong metrics can sabotage security initiatives. The “Whack-a-Mole” Metrics These counterproductive indicators focus solely on vulnerability identification and remediation: Vulnerability Counts - Total vulnerabilities discovered, treating finding more issues as program success Remediation Rate - Speed of fixing vulnerabilities, emphasizing rapid clearing of findings Vulnerability Types Tested - Variety of detectable vulnerability classes, attempting to expand testing scope gradually Number of Products Onboarded - Quantity of applications monitored by the program The Problem: These metrics reinforce misconceptions that application security delays product development rather than enabling it. ...

Application security has traditionally been positioned as corporate insurance against financial losses. This perspective has spawned numerous counterproductive phrases that undermine the discipline. Ten Problematic Mindsets in AppSec Keep The Company Off the Front Page Fear-based messaging is ineffective when breaches occur so regularly that public impact is minimal for most organizations. Security is Non-Functional The notion that security exists outside business functions ignores reality—security is a prioritized requirement like any other business need. ...

“AI created software is coming faster and faster. And the technology to do it is already here. All that is needed is training data and a focus.” Artificial Intelligence will create, test, and deliver software products with accuracy, efficiency, and security. Specialized AI agents will coordinate development across distinct lifecycle phases at inhuman speeds. How Will It Work? A software creator describes their product to an Application Generator (AG), which uses large language models to analyze requirements and interact with the creator to refine them. The AG works alongside a Domain Modeler to establish specifications using domain-specific language. ...

“Automation does not need to be our enemy. I think machines can make life easier for men, if men do not let the machines dominate them.” — John F Kennedy The Evolution of Developer Automation Software engineers have long embraced the philosophy of automating repetitive tasks. The industry has progressively introduced tools that reduce manual work: Early era: Manual debugging through console logging and frequent server restarts IDE advancement: Integrated Development Environments eliminated many routine tasks Modern infrastructure: Docker, Kubernetes, and Terraform automate deployment processes Framework libraries: Open-source solutions handle common functions like JSON parsing and database management These innovations increased developer productivity and lowered barriers to entry, yet professional demand remained stable with salaries exceeding six figures and 150,000+ open positions. ...

Posted on March 6, 2024 MyOwnTutorial is a flexible educational platform where each user plays a key role in system security. Domain-driven design enables tailoring the User Management system to specific roles, emphasizing ubiquitous language that enhances clarity, security, and operational efficiency across the institution. The Significance of Ubiquitous Language in User Management In MyOwnTutorial, adopting ubiquitous language ensures all stakeholders—developers, educators, and administrators—share a unified understanding of roles and operational parameters. This shared language strengthens the security framework. Precisely named events such as “Teacher Onboarding” and “Learner Suspension” establish clear, secure processes that minimize ambiguities potentially exploitable by bad actors. Meticulous naming and management of these events form foundational security defenses. ...

Introduction When developing microservice applications like “MyOwnTutorial”, a critical early decision involves choosing between a consistent technology stack across all services or allowing each service to use its own stack. Benefits of a Consistent Technology Stack Easier Development and Maintenance - Engineers need proficiency in only one set of tools and languages, simplifying both development and uniform updates across services. Simplified Onboarding - New team members need to learn a single stack to contribute to any application component. ...

Core Values Overview Core values serve as “fundamental principles that serve as the bedrock for any design, establishing the essential boundaries and guidelines within which a product must function.” The MyOwnTutorial platform is built on five essential core values: 1. Student Focus The student experience remains paramount. Teachers, administrators, and stakeholders exist to enhance the student’s learning journey. Every feature and policy is evaluated through its impact on students. 2. Privacy by Design Privacy cannot be secondary. All data—from grades and lesson plans to student work—receives the highest confidentiality treatment. Information remains inaccessible unless explicitly designated for sharing. ...

Overview This tutorial addresses the challenge of creating meaningful software examples that bridge the gap between basic tutorials and real-world complexity. Most software security tutorials use overly simplistic examples like to-do applications or focus exclusively on high-value financial data. Purpose The authors aim to demonstrate how integrating security principles—even when not legally mandated—can lead to cleaner implementations and lower total cost of ownership. Using an online educational platform as the example, the tutorial examines three categories of security needs: ...