Secure Code Is Critical Infrastructure: Hacking Policy for Public Good

Secure Code Is Critical Infrastructure: Hacking Policy for Public Good

Speakers: Tanya Janca

Conference: Policy @ DEF CON

YouTube: https://www.youtube.com/watch?v=3V-URruNQck

Overview

In this compelling talk from Policy @ DEF CON, security advocate and author Tanya Janca delivers a passionate and analytical indictment of the Canadian government's approach to software security, framing secure code as an indispensable component of national critical infrastructure. Janca, widely known as SheHacksPurple, argues that the current lack of formal, mandatory, and actionable secure coding policies poses a significant national risk, threatening democracy, citizen privacy, and public safety. Her presentation highlights a critical gap in government cybersecurity strategies, which often prioritize network and physical infrastructure while neglecting the foundational security of the software that underpins all public services.

Janca's talk is not merely a critique but a call to action, empowering security professionals and citizens alike to advocate for systemic change. Drawing on her extensive experience in government and the private sector, she outlines the deficiencies in existing governmental guidance and presents her own comprehensive, agnostic secure coding policy as a blueprint for improvement. The core message is clear: the integrity of public services and the trust of citizens depend on robust software security, and without proactive policy-driven measures, governments remain dangerously exposed to escalating cyber threats. This article delves into Janca's findings, her technical policy recommendations, and the actionable steps she proposes for driving essential reform.

Background

▶ Watch: Advocating for better government software security (0:00)

The problem of insecure software is pervasive, but its implications become particularly acute when it concerns government systems. Tanya Janca, reflecting on her journey from a developer who found policies "annoying" to a cybersecurity expert recognizing their critical importance, highlights a fundamental disconnect. Policies, when poorly written or non-existent, are indeed frustrating. However, well-crafted, actionable policies are indispensable tools for establishing standards, ensuring accountability, and ultimately safeguarding critical assets. Janca's experience as a pentester, where she spent nine months writing policy due to being "too afraid to let me pentest," solidified her understanding of policy's power.

The Canadian government, according to Janca, exemplifies the dangers of this disconnect. She asserts that insecure code for government applications is not merely a technical flaw but a national risk. Compromised government software can lead to service outages, mass data exfiltration of private citizen information, and broader threats to democracy and public safety. The speaker emphasizes that software, though often overlooked, runs everything—from departmental websites to essential services. She recounts an anecdote from her time in government where the organization's website (e.g., departmentname.gc.ca) was deemed "mission critical" because its downtime would cause public panic and even 911 calls.

A significant contributing factor to this insecurity is the educational pipeline. Janca states she has "not met a single university or college that teaches secure coding," with only rare exceptions offering limited web application hacking or application security courses. This means a "zillion developers" are graduating annually without fundamental security knowledge, exacerbating the problem as they enter the workforce. Within the Canadian public service, this lack of foundational education is compounded by a systemic absence of guidance and accountability.

Janca points to several critical deficiencies in the Canadian government's current security landscape, based on publicly available information and her extensive experience:

1. No Formal Secure Coding Policy or Guideline: There is no government-wide, mandatory directive for secure coding practices.
2. Limited Vulnerability Disclosure Program (VDP): While small, isolated initiatives exist (e.g., a limited program with CDS, one for Alberta province, and Canada Post), there is no official government-wide VDP or bug bounty program. Crucially, even where programs exist, there's no safe harbor, meaning researchers can still face legal threats for reporting vulnerabilities.
3. No Government-Wide Education on Software Security: Without guidance or education, departments and developers are left to "do their own thing," leading to inconsistent and often insecure practices.
4. Limited Online Guidance from CCCS (Canadian Centre for Cyber Security): Janca scrutinizes the publicly available guidance from CCCS, highlighting its ineffectiveness:

• Software Security Code of Practice: This document, considered their "best guidance," contains only four vague points related to software security: "use strong authentication," "validate your input" (without clarification), "protect sensitive data" (not vague at all, she notes sarcastically), and "securely store credentials" (no details). It also mentions "secure by design" with "zero examples, zero explanation, zero clarity." This document is not mandatory, high-level, and focuses on processes over actionable details.
• Guidance on Third-Party Components: These documents are also non-mandatory and suggest practices that are "super manual and expensive and doesn't scale." For example, they might suggest an SBOM (Software Bill of Materials) but not mandate analysis of components for safety.
• Security Considerations for Your Website (for the public): This very basic guidance, while accurate, is for the public and not for the government to follow, covering "almost nothing" relevant to robust government software security.

Furthermore, Janca critiques the Canadian government's stated cybersecurity strategy, which emphasizes "whole of society engagement and agile leadership" but, upon closer inspection, reveals significant blind spots regarding software. Initiatives like cybersecurity certifications and consumer protection are almost exclusively focused on IoT (Internet of Things) devices, with "nothing to do with software in there." Talent development efforts are minimal, working with "one university across Canada."

The consequences of this inaction are severe and tangible. Janca cites numerous breaches affecting the CRA (Canada Revenue Agency), Canada's equivalent of the IRS, which holds "extremely personal financial information." In 2015, an investigative journalistic piece by CBC uncovered 42 material breaches that CRA had failed to report. Material breaches signify significant harm, such as organizational damage or the theft of citizen data. Janca herself experienced the impact, with two of her parents' identities being lost. She also criticizes CRA's "abysmal" terms of service, which absolve them of responsibility for user data due to the inherent insecurity of the internet. Beyond CRA, Janca states there are "tons and tons of breaches happening literally all the time" across the Canadian government, many of which go unreported due to reporting thresholds.

Janca's personal efforts to address these issues, including volunteering for ICTC to add cyber to school curricula, promoting Cyber Titan (the Canadian equivalent of Cyber Patriot), guest lecturing, and making her secure coding academy free, have been met with government inaction or dismissal. This consistent stonewalling, despite repeated attempts to engage through various channels, underscores the systemic resistance to change and the urgent need for a more impactful approach.

Key Findings

▶ Watch: Why software security policies are crucial (2:40)

Tanya Janca's presentation underscores several critical findings regarding the state of government software security and the path forward:

• Software as Critical National Infrastructure: The talk fundamentally redefines software as an essential component of national critical infrastructure, on par with physical and network infrastructure. Its insecurity poses direct threats to democracy, citizen privacy, and public safety, as demonstrated by incidents like the CRA breaches and the public panic caused by government website downtime.
• Systemic Policy and Education Gaps: A glaring deficiency exists within the Canadian government, characterized by the absence of a formal, mandatory, and actionable secure coding policy or guideline. This is compounded by a complete lack of government-wide software security education for developers and a higher education system that largely fails to teach secure coding practices.
• Inadequate Existing Guidance: Current guidance from bodies like CCCS is criticized for being vague, high-level, non-mandatory, and process-oriented rather than providing concrete, actionable technical details. Specific examples include the "Software Security Code of Practice" offering only broad principles and third-party component guidance being manual, expensive, and lacking in analysis requirements.
• Government Inaction and Resistance to Change: Despite repeated attempts at engagement, advocacy, and offering free resources by Janca and others, the Canadian government has largely ignored or dismissed these efforts. This highlights a bureaucratic inertia and a perceived lack of accountability that allows widespread insecure practices to persist.
• The Power of Citizen Advocacy: Janca's journey demonstrates that persistent citizen advocacy, leveraging public pressure, social media, and direct engagement with elected officials (like Members of Parliament), is a necessary, albeit challenging, mechanism to force governmental accountability and drive policy reform.
• A Blueprint for Actionable Policy: Janca's significant contribution is the creation of a free, 9-page, agnostic secure coding policy and guideline (securecodingguideline.com). This document serves as a practical, actionable template for any organization or government, offering clear, enforceable rules regardless of technology stack, cloud provider, language, or framework. It directly addresses the gap left by the government's vague and non-mandatory directives.

Technical Deep Dive

▶ Watch: Insecure government code poses national risk (3:20)

While Tanya Janca's talk is not a deep dive into exploit techniques or novel vulnerabilities, it provides a crucial technical deep dive into the architecture of effective security policy and the glaring technical deficiencies in current governmental approaches. The core technical content here lies in the contrast between what should be in a secure coding policy and what is currently available from official Canadian government sources.

Janca meticulously deconstructs the inadequacy of the Canadian Centre for Cyber Security (CCCS) guidance, which she identifies as the primary public-facing resource for software security. She highlights that their "best guidance," the Software Security Code of Practice, offers only four extremely high-level and vague recommendations:

1. Strong Authentication: No clarification on what constitutes "strong" or how to implement it securely.
2. Validate Your Input: A critical security control, but without any details or examples on how to perform validation effectively (e.g., whitelist vs. blacklist, data type, length, and format validation).
3. Protect Sensitive Data: A broad mandate with no specific instructions on encryption, access controls, data minimization, or secure storage.
4. Securely Store Credentials: Again, lacking any actionable guidance on best practices like hashing, salting, key management, or avoiding hardcoding.

Beyond these four points, the CCCS document includes "secure by design," which Janca notes comes with "zero examples, zero explanation, zero clarity." This level of abstraction renders the policy effectively useless for developers seeking concrete instructions. Furthermore, the guidance is "not mandatory" and "focuses on processes over details," creating a culture where accountability is absent, and "yolo" (you only live once) development practices prevail.

Janca also criticizes the CCCS guidance on third-party components, which is similarly non-mandatory and suggests practices that are "super manual and expensive and doesn't scale." While it might suggest generating a Software Bill of Materials (SBOM), it notably "does not suggest that you should analyze any of your components to see if they're safe." This omission is critical, as an SBOM without analysis provides little security benefit. The implied approach would require "12 people... to manually review every single component," an unrealistic expectation for most development teams. Even a "slightly better" but still non-mandatory document on third-party components remains prohibitively expensive and lacks scaling solutions.

In stark contrast to these deficient official documents, Janca presents her own Secure Coding Policy and Guideline (available at securecodingguideline.com). This document is designed to be the antithesis of the government's current offerings:

• Actionable: It provides concrete, implementable advice that developers can immediately understand and apply. Janca states, "You can put this in any developer's hands and they know what to do."
• Agnostic: Crucially, the policy is designed to be independent of specific technologies. "It doesn't matter what your stack is. Doesn't matter what cloud you're using. It doesn't matter what language you're using, which framework. It applies to everything." This broad applicability ensures its utility across diverse government departments and private sector organizations.
• Concise and Comprehensive: At only "nine pages," it avoids the overwhelming length of many traditional policies while still covering essential secure coding principles. Its content is based on her best-selling book, "Alice and Bob Learn Secure Coding," ensuring a solid theoretical and practical foundation.

The technical deep dive in this talk is thus less about specific code exploits and more about policy as a critical security control. Janca argues that without a technically sound, actionable, and mandatory policy, all other security efforts risk becoming fragmented and ineffective. The design principles of her policy—actionability, agnosticism, and conciseness—represent a robust technical architecture for secure software development, directly addressing the systemic failures she observes in government.

Demo / Proof of Concept

▶ Watch: Government websites are critical infrastructure (5:15)

While Tanya Janca's presentation did not feature a live technical demonstration of an exploit or a coding walkthrough, her talk itself served as a powerful "proof of concept" for two distinct but related initiatives: the efficacy of a well-structured secure coding policy, and the potential impact of sustained citizen advocacy.

The primary "demonstration" was the unveiling and provision of her Secure Coding Policy and Guideline. Janca made this 9-page document freely available to the audience and the public via a direct link (securecodingguideline.com) and QR codes. She emphasized its design principles: it is "completely actionable advice," "agnostic" across technology stacks, clouds, languages, and frameworks, and based on the best practices outlined in her book, "Alice and Bob Learn Secure Coding." This policy document, with its clear, enforceable rules, stands as a tangible counter-example to the vague, non-mandatory, and ineffective guidance currently offered by the Canadian government. It serves as a practical blueprint, demonstrating how a government could implement robust software security standards.

Beyond the policy itself, Janca detailed her extensive, multi-year campaign of advocacy, which acts as a "proof of concept" for civic engagement in cybersecurity policy. Her efforts include:

• Direct Engagement with Officials: Repeatedly contacting the CRA, writing letters to the Prime Minister's Office, various government departments (Public Safety Commission, Privacy Commissioner, Department of Defense), and Members of Parliament (MPs). She recounted a direct, polite but firm confrontation with the CRA's Chief Information Officer, where she pointed out the lack of adherence to web application policies, only to be met with dismissive responses.
• Public Awareness Campaigns: Writing blogs (including on Risky Business), conducting numerous interviews with media outlets like CBC (Canada's national news organization), and leveraging social media to raise public awareness about the government's cybersecurity shortcomings.
• Legislative Engagement: Working with her local MP on a letter-writing campaign, and actively seeking a new MP to sponsor a House of Commons petition. She outlined the process for such a petition, which, with 500 signatures, would compel the government to book an appointment and listen to her directly for 20 minutes in Ottawa.
• Community Mobilization: Collaborating with OWASP (Open Web Application Security Project) chapters across Canada to gather signatures and support, demonstrating how grassroots efforts can build momentum.
• Grassroots Implementation: Her discussion with a CISO from British Columbia about adopting her policy across the province illustrates a bottom-up approach to policy implementation, potentially creating a domino effect across other provinces and embarrassing the federal government into action.

Janca's "demo" wasn't about showing a vulnerability, but about showing the solution—a well-written policy—and the method for getting it adopted—relentless, informed advocacy. Her presentation itself served as a powerful demonstration of her commitment and the potential for a single, determined individual to challenge systemic complacency.

Defensive Implications

▶ Watch: Current security landscape in Canada (Tanya's view) (6:20)

Tanya Janca's talk delivers critical insights and actionable strategies for cybersecurity defenders, extending beyond the Canadian context to any organization grappling with software security. The core defensive implication is the absolute necessity of proactive, mandatory, and actionable secure coding policies as a foundational element of any robust security program.

Here's what defenders should do with this information:

1. Prioritize Policy Development and Enforcement: Do not wait for external mandates. Develop or adopt a clear, concise, and actionable secure coding policy for your own organization. Janca's free guideline (securecodingguideline.com) serves as an excellent, agnostic template that can be immediately implemented or adapted, regardless of your technology stack. Ensure this policy is not merely aspirational but has mechanisms for enforcement and accountability.
2. Advocate for Secure Coding Education: Recognize the systemic failure in higher education. Internally, invest in continuous secure coding training for all developers, leveraging resources like Janca's free academy courses. Externally, engage with local universities and colleges to demand the inclusion of secure coding in their computer science and software engineering curricula. This addresses the problem at its source, building a more security-conscious workforce.
3. Engage in Proactive Advocacy: If operating within a governmental or heavily regulated sector, learn from Janca's persistent advocacy. Contact local officials, elected representatives, and relevant government agencies. Frame software security as a critical infrastructure issue, emphasizing its impact on national security, privacy, and public trust. Utilize public channels like social media to amplify concerns and build collective pressure.
4. Implement Robust Vulnerability Disclosure Programs (VDPs): For organizations handling sensitive data, establish clear, safe, and public VDPs. Ensure these programs include safe harbor provisions to protect security researchers who report vulnerabilities in good faith. This fosters collaboration with the security community, leading to earlier detection and remediation of flaws.
5. Challenge Vague Guidance: Critically evaluate any existing security guidance or policies. If they are high-level, non-mandatory, or lack actionable details (like the CCCS examples Janca cited), push for their revision. Advocate for policies that specify how to implement security controls, not just what controls are needed.
6. Recognize Software's Criticality: Elevate software security discussions to the executive and board levels. Ensure that software is explicitly recognized as critical infrastructure, warranting dedicated resources, budget, and strategic attention, on par with network and physical security. Use metrics and examples (like the CRA breaches) to demonstrate the tangible risks of insecure software.
7. Leverage Available Resources: Take advantage of the free resources Janca provides:

• Secure Coding Guideline: A ready-to-use policy template.
• Books: "Alice and Bob Learn Secure Coding" for developers, and "Application Security" for building AppSec programs.
• Free Academy: Offers courses on secure coding, building an AppSec program, and incident response.
• Newsletter: A way to stay informed about ongoing advocacy and new resources.

By proactively implementing clear policies, investing in education, and engaging in informed advocacy, defenders can significantly improve their organization's security posture and contribute to a broader culture of secure software development, even in the face of governmental inertia.

Key Takeaways

• Insecure government software poses a significant national risk, impacting democracy, citizen privacy, and public safety, underscoring software's role as critical infrastructure.
• The Canadian government currently lacks mandatory, actionable secure coding policies and comprehensive software security education for its developers, leading to widespread vulnerabilities.
• Existing official guidance on software security is often vague, non-mandatory, and insufficient, focusing on high-level processes rather than concrete, implementable technical details.
• Proactive citizen advocacy, public pressure, and direct engagement with elected officials are crucial mechanisms to overcome governmental inertia and drive essential policy reform in cybersecurity.
• Tanya Janca's free, 9-page, agnostic secure coding guideline provides a practical and actionable template for any organization or government to establish clear, enforceable software security standards.
• Educational reform, both within universities and through continuous professional development, is vital to equip developers with fundamental secure coding knowledge from the outset.

About the Speaker(s)

Tanya Janca, also known as SheHacksPurple, is a prominent figure in the application security community and a passionate advocate for secure coding practices. She serves as a Security Advocate at SRP and is the author of two acclaimed books: "Alice and Bob Learn Secure Coding" and "Application Security." Janca's extensive career in technology includes founding multiple initiatives, advising two startups, and working as a secure code trainer. She is also a board member, though she humbly notes this detail didn't make her slide.

Prior to her current roles, Janca spent 13.5 years working for the Canadian government, leaving in February 2018. This firsthand experience provides her with unique insights into governmental processes and the challenges of implementing security within large public sector organizations. Since 2018, she has volunteered with the Information and Communication Technology Council (ICTC), working to integrate cyber education into high school and primary school curricula, serving as the "ethical hacker lesson" in career textbooks. She has also organized security professionals for career days and supported funding for Cyber Titan (Canada's equivalent of Cyber Patriot) for high school students. Driven by a deep commitment to change, Janca has made her entire academy of secure coding and application security courses available to the public for free. Her talk at Policy @ DEF CON highlights her ongoing, tireless efforts to push for secure coding policies within the Canadian government, leveraging her expertise and public platform for the greater good.