Building a Security-First Engineering Culture

October 3, 2016

The traditional approach to security treats it as a gate: build the feature, then have security review it before release. This approach fails for multiple reasons:

A better approach integrates security throughout development. Every engineer considers security. Every code review examines security implications. Every architecture discussion addresses security requirements. Security becomes culture, not a checkpoint.

What Security-First Culture Looks Like

In a security-first organization:

Engineers think about security by default. When designing features, they consider authentication, authorization, data protection, and attack vectors without being prompted.

Security is part of definition of done. Features aren’t complete until security considerations are addressed—not perfect, but consciously considered.

Security findings are learning opportunities. When vulnerabilities are found, teams learn from them rather than blame individuals.

Security team enables rather than blocks. Security specialists help engineers make good decisions rather than gatekeeping releases.

Security investments are valued. Time spent on security improvements is respected, not treated as overhead.

Building the Culture

Culture change requires sustained effort across multiple dimensions.

Start with Leadership

Engineering leadership must visibly prioritize security:

Without leadership support, security will always lose to feature pressure.

Security Training

Engineers can’t consider security if they don’t understand security. Provide training:

Foundational training: OWASP Top 10, secure coding principles, threat modeling basics. Every engineer should have this baseline.

Language/framework-specific training: Security patterns in your stack. How to prevent SQL injection in your ORM. How to handle authentication in your framework.

Specialized training: Advanced topics for interested engineers. Penetration testing, cryptography, security architecture.

Make training accessible and ongoing, not a one-time checkbox.

Security Champions

Security champions are engineers embedded in teams who advocate for security:

Champions distribute security knowledge across the organization. They ensure security perspective is present in design discussions without requiring security team involvement in everything.

Secure Development Practices

Integrate security into development workflow:

Threat modeling: During design, identify what could go wrong. What data needs protection? Who might attack this? What are the trust boundaries?

Security code review: Code reviewers explicitly consider security. Authentication checks, input validation, authorization, sensitive data handling.

Security testing: Include security tests alongside functional tests. Input validation tests, authentication tests, authorization tests.

Dependency scanning: Automatically check dependencies for known vulnerabilities. Block builds or alert on vulnerable dependencies.

Static analysis: Run security-focused static analysis tools as part of CI. These catch common vulnerability patterns automatically.

Make Secure Choices Easy

Developers take the path of least resistance. Make the secure path the easy path:

Secure defaults: Frameworks and libraries should be secure by default. Authentication required by default. Encoding by default. Encryption by default.

Approved patterns: Provide templates and examples for common security tasks. “Here’s how to authenticate users in our system.” Engineers follow examples; make the examples secure.

Internal libraries: Build shared libraries that handle security correctly. If every team implements authentication differently, some will get it wrong. If everyone uses a shared authentication library, security is centralized.

Guardrails: Automated checks that prevent obvious mistakes. Can’t deploy without authentication. Can’t store secrets in code. Can’t use deprecated cryptography.

Constructive Security Review

When security specialists review work:

Collaborate, don’t audit. Work with engineers to understand context and find solutions, not just enumerate problems.

Prioritize findings. Not every issue is equally important. Help teams understand what to fix now versus later.

Explain the why. Don’t just say “this is insecure.” Explain the attack vector, the impact, and the reasoning.

Suggest solutions. Don’t just identify problems. Help find solutions that balance security with other requirements.

Learn from patterns. When you see the same mistake repeatedly, address it through training or tooling, not individual reviews.

Handle Incidents Constructively

Security incidents reveal what needs improvement. Use them as learning opportunities:

Blameless postmortems: Focus on systems and processes, not individuals. What allowed this vulnerability to exist? What can we change?

Share learnings: When incidents occur, share what happened and what we learned (appropriately anonymized if needed). Entire organization learns, not just affected team.

Track improvements: Ensure postmortem actions actually happen. Incomplete follow-through erodes trust in the process.

Common Obstacles

“We don’t have time”

Security debt compounds like technical debt. Ignoring security doesn’t save time; it defers costs and increases them.

Address this by:

“Security slows us down”

This is sometimes true, especially early in culture change. Address by:

The goal is fast and secure, not a tradeoff between them.

“That’s the security team’s job”

In organizations with security teams, engineers sometimes defer all security thinking to specialists. This doesn’t scale and creates bottlenecks.

Address by:

“We’ve never had a breach”

Absence of detected breaches doesn’t mean security is adequate. You might not detect breaches. You might have been lucky. The threat landscape changes.

Address by:

Measuring Progress

Track indicators of security culture:

Training completion: Are engineers completing security training?

Vulnerability trends: Are similar vulnerabilities recurring, or are new issues novel?

Security champion coverage: Do all teams have security champions?

Time to fix: How quickly are security issues addressed?

Security findings per review: Decreasing findings might indicate either improving code or complacent review. Investigate.

Penetration test results: External assessments reveal gaps internal processes miss.

Don’t rely on any single metric. Goodhart’s law applies: metrics become targets and lose value as indicators.

The Long Game

Security culture change takes years, not months. Habits are hard to change. Training takes time to absorb. Trust builds slowly.

Persist through early challenges. Celebrate progress. Adjust approach based on what works in your organization. Eventually, security thinking becomes automatic—the way work happens, not an extra burden.

Key Takeaways