“Have heard of it”: a study with practitioners on adoption of secure software development frameworks

Abstract

The ever-growing incidence of software vulnerabilities giving rise to devastating cyber attacks pushes organizations and governments to take software security more seriously. To avoid vulnerabilities, organizations producing software strive to adopt secure software development frameworks (SSDFs). Our mixed-methods study with software development practitioners focuses on the SSDFs’ adoption trends and examines the key factors influencing organizational decisions regarding secure software development. Our findings from a survey (n=37) and interviews (n=8) with software development practitioners indicate that, while being aware of the existing SSDFs, organizations mostly use custom-made frameworks that afford more flexibility and align better with the development processes.