How Developers Secure AI-Generated Code: 5 Security Best Practices — Transcript

Full transcript

1. 0:00AI is changing software development faster than any technology shift we've seen in decades.
2. 0:0540 years ago, when I was banging out code in the early days of my career, the process was incredibly complex, time-consuming, and error-prone.
3. 0:15Today, developers can generate code, tests, agents, multi-step AI tasks, and even workflows with just a prompt.
4. 0:24Quite simply, AI is a game changer.
5. 0:27But there's a challenge.
6. 0:28Security practices that were designed for human written code and slower development cycles don't automatically scale to AI assisted development.
7. 0:36If security only happens at the end of the process as a retrofit, the quality suffers and the whole process comes to a screeching halt.
8. 0:46The solution comes from an unexpected source.
9. 0:50It turns out that Beyonce knew what she was talking about when she sang to the left, to the lift.
10. 0:55Yeah, security needs to shift.
11. 0:58To the left.
12. 0:59Security begins at the earliest stages of development and continues throughout the software development cycle if we're doing it correctly.
13. 1:07These concepts aren't new, although to be honest, we haven't always practiced them as we should,
14. 1:12but in the AI era, shift left means more than just running a few security tools earlier in the process.
15. 1:20It means things like this.
16. 1:22What?
17. 1:23Are we gonna validate?
18. 1:25When do we validate it?
19. 1:27And how do we build confidence in AI-generated solutions?
20. 1:32Let's take a look at five key principles of shift-left security to improve the results of AI-assisted development.
21. 1:40AI-Generated code does not equal trusted code.
22. 1:44So the first principle is simple.
23. 1:46Trust the outcome, not just the generation.
24. 1:50One of the most deceptive things about AI-generated code.
25. 1:53Is that it often looks correct.
26. 1:55It compiles, it runs, it passes all the security tests.
27. 2:00So we think this is okay, but it can still create a security risk down below that you don't see.
28. 2:08And that's the part that we're not aware of.
29. 2:11Just because the technical implementation appears successful doesn't mean the solution is secure.
30. 2:17Developers increasingly need to validate things like the permissions, the data leaks.
31. 2:23If those are occurring, and how are we handling failures?
32. 2:27Does the system fail safe or fail in an open dangerous condition?
33. 2:31For example, an AI-generated service might correctly retrieve customer information from the database,
34. 2:37but should it really have access to all of the information that's in there?
35. 2:43Is sensitive data potentially being exfiltrated from the organization?
36. 2:48What happens if authentication fails?
37. 2:50And also what happens if malformed data ends up into this database and corrupts it.
38. 2:57Well, this is the stuff that's not so easy to see.
39. 3:01This is the part that has asked the question, not just does the code work, but is it secure?
40. 3:08The question that does the cold provide expected results and behave securely under real world conditions is what we need to be asking.
41. 3:17That's the outcome we need validate.
42. 3:20The second principle is security starts during development.
43. 3:24Traditionally, many organizations treated security reviews almost as an afterthought.
44. 3:29So what would happen is, we've got developers finish their coding, then the components are built, the functions are tested, the code gets committed, and then the security review happens.
45. 3:42Basically, it's a checkbox at the end of the process.
46. 3:45That model never really worked well and struggles even more in an AI assisted development environment.
47. 3:51Because history teaches us that the earlier you find a bug, the cheaper it is to fix.
48. 3:58If you find it once it's already gone into production, super expensive.
49. 4:03Find it early in the process is pretty cheap.
50. 4:06And security bugs are actually no different in that regard.
51. 4:09And when code generation can happen in seconds, waiting until the end creates bottlenecks and increases risk.
52. 4:17So shift left security improves validation into the development process itself.
53. 4:23This means automatically running static source analysis, dynamic pin testing, penetration testing, scanning for embedded secrets, policy validation, compliance checks, all of that stuff, and doing this while the code is being created.
54. 4:41The goal here is to reduce unpleasant surprises later in the life cycle by shifting left.
55. 4:47Here's an important reality of AI-generated development.
56. 4:50AI doesn't just create code.
57. 4:53It also introduces dependencies.
58. 4:56So we've got things like new packages, new libraries, new services, new integrations.
59. 5:04Every dependency adds capability, which is good, but every one of those dependencies also adds risk, which isn't so good.
60. 5:12Developers often focus on reviewing generated source code while overlooking what that code depends on.
61. 5:18It's all happening under the covers through the miracles of AI.
62. 5:22So it's kind of out of sight, out of mind.
63. 5:24But security incidents originate from the software supply chain rather than just the application logic itself in some cases.
64. 5:32That's why generated dependencies should also undergo the same level of scrutiny as the generated code.
65. 5:39We need to review things like package reputation, vulnerabilities, licensing, source integrity.
66. 5:48Organizational standards.
67. 5:50In AI assisted development, dependency validation isn't optional.
68. 5:55It's part of secure code generation.
69. 5:58This may be the most important shift of all.
70. 6:01Many serious security issues aren't caused by poor coding practices.
71. 6:05They're caused by incorrect assumptions.
72. 6:08Consider questions like who should actually access the data and what actions are allowed?
73. 6:15What business rules need to be applied?
74. 6:19And what information should remain protected.
75. 6:22An AI model may generate code that is technically elegant and follows development best practices, but if the requirements are misunderstood, the solution can still violate security policies.
76. 6:34Here's what I mean.
77. 6:35A generated workflow may correctly process financial data, yet at the same time, it may also expose that information to users who should never see it in the first place.
78. 6:48That's not as much a coding problem as it is an intent problem.
79. 6:51So we have to consider the intent with this.
80. 6:54And with AI, you have to be especially clear about that intent.
81. 6:59In Greek mythology, King Midas wished that everything he touched would turn to gold.
82. 7:04He got his wish and nearly starved as a result because it turns out you can't eat gold.
83. 7:10As AI generates increasingly sophisticated code at machine speed, developers become more responsible for validating the output.
84. 7:18There's still work for you to do here.
85. 7:20In other words, we're no longer just reviewing code quality, we're reviewing whether the AI solved the right problem in the right way.
86. 7:29The fifth principle is that security must become an ongoing practice, not just some final checkpoint at the end.
87. 7:36As I mentioned previously, organizations have historically concentrated security activities near release at the ended.
88. 7:43But AI assisted development produces change continuously.
89. 7:48Which also means security validation must also happen, wait for it, continuously.
90. 7:55That means it's gonna continue even after release.
91. 7:59So if you think about the process, we develop, test, deploy, monitor, and improve, and all of that stuff needs security.
92. 8:10Security operates in every one of those components in the loop.
93. 8:15So how would we realize that?
94. 8:17Where we've got to have things like vulnerability detection, using some of the best AI frontier models as well so that we're right on top of all the vulnerabilities.
95. 8:27We're going to do dependency monitoring and patching.
96. 8:30We're gonna also do policy verification and enforcement and change validation.
97. 8:37So the question isn't just did it pass once, but does it continue to pass?
98. 8:44Does it continue be secure?
99. 8:46The question is whether confidence is maintained over time.
100. 8:50For instance, an AI frontier model recently found a zero day vulnerability in an open source operating system that had been hiding in plain sight for 27 years.
101. 9:02Lesson from that, security is never done.
102. 9:05It has to become a living part of the process that evolves alongside the software.
103. 9:11As AI becomes more agentic, it will increasingly perform multi-step work.
104. 9:16Across services, repositories, pipelines, and configurations.
105. 9:21At that point, reviewing individual files becomes insufficient.
106. 9:26Security depends on understanding the entire workflow.
107. 9:29The hardest security problems aren't hidden in a single function.
108. 9:33They're found in unintended consequences across connected systems.
109. 9:37That means agents need guardrails to tell them what they can and can't do, what is appropriate and what's not.
110. 9:44They need identities so that they're accountable and we can see who did this and why they need access controls that limit the access capabilities that they
111. 9:57have so that they can't change things we didn't intend and they need monitoring and human in the loop oversight
112. 10:04without the proper oversight and enforcement agents can run amok and act as risk amplifiers rather than productivity tools.
113. 10:14Here's the new reality. We have to secure fast and validate continuously.
114. 10:19AI is accelerating software development.
115. 10:22That means we can generate more code in a minute than we used to be able to do in an entire day.
116. 10:27And that means we're gonna generate a lot more code.
117. 10:30And that mean more code means more functionality.
118. 10:34It also means more complexity.
119. 10:37And complexity is the enemy of security.
120. 10:40Speed alone doesn't create value, trust does.
121. 10:43The organizations that succeed will be the ones that embed security directly into everyday development workflows.
122. 10:50Not as a compliance exercise, not as a release gate, but as a continuous validation practice.
123. 10:56Because in the age of AI assisted development, the goal is no longer to simply review the code.
124. 11:02The goal is to confidently verify outcomes across an ever expanding and increasingly complex code base and do it faster than we've ever done before.
125. 11:13And remember to the left, to the left.