"The number one thing you should do to improve the security of what you've built is to make your product Open Source Software," says Bill Franklin, co-founder of Lavaboom, a secure email developer.
Let's face it: we are all human. No matter how much we may have poured over our code, we still might miss a security flaw here and there. That's why open source software is so valuable. Also, remember that OSS is a two-way street. That means that you can and should refer to other people's code when developing your products.
Of course, Franklin points out there are some downsides to OSS. Competing companies could steal tasty bits of your code and repackage them in their own solutions. Additionally, open source means that anyone can look at your code—including attackers who might want to exploit your networks. These drawbacks notwithstanding, there is power in a community of skilled developers inspecting your software for vulnerabilities.
Systems development life cycle (SDLC) refers to a process that companies should abide by when developing IT products. It requires that developers constantly refine their products' code and check for vulnerabilities in each stage of development—a process which emphasizes secure, fully tested IT products.
We can analyze, test, and share the code of our IT products as much as we want, but even then attackers may still get in. Acknowledging this, it's always important to have a vulnerability response team at the ready.
"A very important component for us is our vulnerability response teams that monitor for new vulnerabilities in the market," explains MacVittie.
We all want to develop the most secure IT products possible. By making our products open source software, testing often, adopting an SDLC approach and thinking about future vulnerability response, we can all deepen the security of our products and, by extension, improve users' experience.