Threat Modeling Developer Behaviour: The Psychology of Bad Code - Tanya Janca
Security vulnerabilities are often predictable patterns of human behavior rather than purely technical flaws. The talk advocates for shifting AppSec focus from merely enforcing secure coding standards to understanding and modifying developer psychology using principles from behavioral economics. Key strategies include setting 'secure defaults,' embedding security activities into every phase of the SDLC, and implementing cultural changes (like community practices) to make secure development the path of least resistance.
Key takeaways
-
The Shift from Intentions to Defaults
26:23
Since 'secure intentions' require constant effort and willpower, organizations should implement 'secure defaults.' This means structuring tools and processes so that the secure path is the automatic, easiest choice (e.g., using an ORM framework that enforces parameterized queries instead of allowing raw SQL concatenation).
-
Addressing AI-Generated Code Risks ('Vibe Coding')
31:30
A major risk is 'vibe coding,' where developers rely on AI to write nearly all the code without thorough manual review. Mitigation requires using Retrieval Augmented Generation (RAG) servers that reference secure internal guidelines and enforcing mandatory human code reviews.
-
Systemic Process Improvement
20:50
Instead of blaming individuals, security failures should be viewed as systemic issues. Solutions must involve embedding security activities (like threat modeling) into requirements gathering and design phases, making it a continuous part of the SDLC.
-
Behavioral Nudges over Mandates
27:10
Effective change comes from 'nudges'—subtle changes in environment or process that guide behavior without restricting options. Examples include automatically enrolling employees in retirement plans (opt-out) or adding documentation debt to sprint reviews.