Effective secure software development

Abstract

Despite continuous efforts to improve software security, vulnerabilities continue to emerge. Organizations therefore integrate security practices into the Software Development Lifecycle (SDLC). However, many still struggle to select and implement practices that effectively improve software security. A key challenge is balancing security with business pressures, including cost, user experience, and delivery deadlines. With numerous practices, tools, and training initiatives available, implementing everything is unrealistic, making effective prioritization essential.

Security practices do not improve software security automatically; their effectiveness depends on how they are selected, interpreted, and implemented by the professionals responsible for developing and securing software. Consequently, effectiveness is influenced not only by technical solutions but also by practitioners’ judgment, experience, and organizational context.

In this dissertation, we investigate effective secure software development from the perspective of security practitioners. Through their practical experience, practitioners develop perceptions of which security practices contribute most to improving software security. By examining these perspectives, this thesis aims to conceptualize how effectiveness is understood in secure software development and provide insights to help organizations make better-informed decisions when adopting and prioritizing security practices.