SecTor 2025 | Hacking Policy for the Public Good

Why It Matters

A mandatory, enforceable secure‑coding policy would reduce systemic breaches, protect citizens' data, and safeguard the integrity of Canada’s digital government services.

Key Takeaways

• Canada lacks a mandatory, detailed secure coding policy for federal agencies.
• Existing guidance is vague, non‑mandatory, and fails to hold developers accountable.
• Over 600,000 Canadian developers receive little to no security training.
• Repeated data breaches (e.g., CRA) expose citizens and erode public trust.
• Advocacy and a petition aim to push the government toward concrete standards.

Summary

Tanya Jen, a former Canadian government security lead turned independent advocate, used her SecTor 2025 talk to spotlight the nation’s glaring absence of a mandatory, detailed secure‑coding policy for federal agencies. Drawing on her 13‑year tenure—including pentesting the prime minister’s website and overseeing the 2015 election’s security—she now leverages her freedom from NDAs to critique the status quo and propose concrete reforms. She outlined how existing guidance—such as the Canadian Centre for Cyber Security’s “Software Security Code of Practice”—is high‑level, non‑mandatory, and devoid of actionable examples, leaving developers to interpret vague terms like “sanitize” versus “validate.” The speaker highlighted systemic gaps: no government‑wide vulnerability disclosure program, no bug bounty, and virtually no secure‑coding training for the estimated 600,000 Canadian developers, many of whom build the software that underpins critical public services. Jen illustrated the stakes with personal anecdotes: she hacked the prime minister’s site with permission, witnessed the Canada Revenue Agency hide 42 material breaches, and saw her own parents fall victim to credential‑stuffing attacks. These incidents underscore how insecure code jeopardizes privacy, public safety, and democratic confidence, especially when basic web security headers and session handling are ignored. The talk concluded with a call to action—presenting a draft secure‑coding policy, urging audience signatures on a petition, and demanding that the government adopt enforceable standards. Without such policy, Canada risks continued breaches, eroding citizen trust and exposing the nation’s digital infrastructure to escalating threats.

Original Description

What happens when a security professional tries to help a government fix its insecure software?

In this talk, I'll share my story: from writing a secure coding policy and offering it to the Canadian government, lobbying elected officials, contacting agencies like CRA about their poor security practices—and being met with silence, deflection, or outright dismissal.

I didn't stop there. I wrote public letters, went on podcasts, published on Risky Biz, and even got interviewed by CBC. But the institutions in charge of protecting our data? Either silence or "No comment, because security."

This isn't just a rant—it's a roadmap. I'll show you the secure coding guideline I created (free to reuse), explain why governments need public-facing AppSec policies, and outline how we can push for secure-by-default practices as citizens, hackers, and builders.

Because secure code isn't just for dev teams—it's for democracy, privacy, and public safety.

Let's make it law. Let's make it public.

By:

Tanya Janca | CEO and Secure Coding Trainer, She Hacks Purple Consulting

Presentation Materials Available at:

https://blackhat.com/sector/2025/briefings/schedule/?#secure-code-is-critical-infrastructure-hacking-policy-for-the-public-good-47030