By Tanya Janca
This is a series. Previous posts: #1, #2, #3, #4, #5, #6; this is the seventh. The Psychology of Bad Code is a framework, developed by Tanya Janca, that maps common secure coding failures to the specific cognitive biases that drive them, paired with structural fixes for each. Repetitive code reuse and lazy error handling… Continue reading The Psychology of Bad Code Part 7 – “It Worked Last Time”
This is a series. The first blog post is here, #2, #3, #4, #5, and this is the sixth. The behaviour: Avoiding Documentation What this looks like in the real world The cause is often cultural: I’ve worked at places where I KNEW no one was reading the docs I wrote. I did eventually learn… Continue reading The Psychology of Bad Code Part 6 – Avoiding Documentation
This is a series. The first blog post is here, #2, #3, #4, and this is the fifth. The behaviour: Shiny New Tech Using a brand-new technology, language, and/or framework, even when it’s not necessarily the best thing to use. Especially if it’s untested, and there’s little guidance or tools available for it. An obsession… Continue reading The Psychology of Bad Code Part 5 – Shiny New Tech
This is a series. The first blog post is here, #2, #3, and this is the forth. The behaviour: Copy and Pasting from online forums What this looks like in the real world This often shows up when we are stuck, frustrated, or rushed. This is often used to solve complex syntax or integration issues.… Continue reading The Psychology of Bad Code Part 4 – Copy Paste
This is a series. The first blog post is here, the second is here, and this is the third. For the rest of this series, I am going to follow a similar format for each post/behavior. I will name the behavior, then various biases and heuristics that I believe apply, and then give some examples… Continue reading The Psychology of Bad Code Part 3 – Vibe Coding
In my previous blog post, I introduced the topic of applying behavioral economics to application security programs, using proven behavioral economic interventions to help us avoid known bad developer behaviors (including ones I know I am guilty of). In this post I am going to cover building systems that support secure developer behavior, that can… Continue reading The Psychology of Bad Code Part 2…
In this blog series I will explore several known bad developer behaviors that lead to insecure software, as well as how we can combat them by applying behavioral economic interventions. This series is an expansion upon my thoughts from my conference talk ‘Threat Modeling Developer Behavior: The Psychology of Bad Code’.
– By someone who really wants you to succeed! Finding your first job in cybersecurity (which us security nerds call ‘InfoSec’) can feel overwhelming. There are way too many job titles, technologies, and acronyms to keep track of. There’s also no clear career or training pathway to get there (for instance, if you want to… Continue reading How To Get Your First Job In Cybersecurity
Recently I hosted a webinar called “Metrics, Models, and Mindsets: The Future of Application Security” with: Our goal was simple: talk honestly about where application security is going, and what’s actually working (and not working) in real teams today. You can watch the conversation below: Meet the Panel Big Question: Building an AppSec Program with… Continue reading Metrics, Models, and…
When we talk about the software supply chain security, most people think only of dependencies (open-source libraries and frameworks). But the supply chain is so much more than just that. It’s everything we use to build, test, and release our software: our IDE (and all those wonderful extensions), our CI/CD pipelines (including every script, config,… Continue reading Software Supply Chain: Bigger…