Incorporating software security: using developer workshops to engage product managers

Abstract

Evidence from data breach reports shows that many competent software development teams still do not implement secure, privacy-preserving software, even though techniques to do so are now well-known. A major factor causing this is simply a lack of priority and resources for security, as decided by product managers. So, how can we help developers and product managers to work together to achieve appropriate decisions on security and privacy issues? This paper explores using structured workshops to support teams of developers in engaging product managers with software security and privacy, even in the absence of security professionals. The research used the Design Based Research methodology. This paper describes and justifies our workshop design and implementation, and describes our thematic coding of both participant interviews and workshop discussions to quantify and explore the workshops’ effectiveness. Based on trials in eight organizations, involving 88 developers, we found the workshops effective in helping development teams to identify, promote, and prioritize security issues with product managers. Comparisons between organizations suggested that such workshops are most effective with groups with limited security expertise, and when led by the development team leaders. We also found workshop participants needed minimal guidance to identify security threats, and a wide range of ways to promote possible security improvements. Empowering developers and product managers in this way offers a powerful grassroots approach to improve software security worldwide.

Security risks in the software development lifecycle: A review

“…the authors in [30] explain that the primary reason why software development teams do not implement security is due to a lack of knowledge and experience in different types of vulnerabilities. This is supported by the authors in [31], who point out that datamany competent software development teams still do not implement secure, privacy-preserving software, even though techniques to do so are now well-known. The major cause of this is lack of priority and resources for security.…”

Securing Software Development: A Holistic Exploration of Security Awareness in Software Development Teams

“…Security concerns are not implemented by software engineers as a continuous process in early software development; they are valued at the end of software development (Humayun et al, 2023;Nazir & Nazir, 2018). According to the research "Veracode, 2018," software developers aren't paying enough attention to security issues; therefore, all applications are vulnerable to threats (Weir et al, 2022). The majority of software engineers initially do not care about security concerns, Yet, the software engineers are gradually realizing that security for requirements engineering is essential for software development (Weir et al, 2021;Weir et al, 2022).…”

“…According to the research "Veracode, 2018," software developers aren't paying enough attention to security issues; therefore, all applications are vulnerable to threats (Weir et al, 2022). The majority of software engineers initially do not care about security concerns, Yet, the software engineers are gradually realizing that security for requirements engineering is essential for software development (Weir et al, 2021;Weir et al, 2022). According to recent study, many software development procedures do not clearly contain methods for integrating software security from the early stages of software development (Khan & Khan, 2018b).…”