Work

“Immediateshortterm3mthsafterthatlol”: Developer Secure-Coding Sentiment, Practice and Culture in Organisations

Year: 2025

Type: conference-paper

Abstract: As almost all areas of human endeavour undergo rapid digital transformation, secure coding is increasingly important to personal, commercial and national security. Yet studies have shown that software developers do not always prioritise or even understand security. Our large survey of organically sourced coders ($n=863$) examines how software developers currently experience secure coding in the workplace. We found that developers express an interest in secure coding, display basic security knowledge, and turn to their managers and teams first for help with security concerns. We found that developer secure coding sentiment and security practice do not correlate with organisational statistics such as size, but do correlate weakly with measures of security culture, indicating that organisational security support goes hand-in-hand with secure development. Most developers would look for help in-house if they had security concerns. Investigating the effects of code breaches, we found that for almost half of cases, code security does not increase, or increases only for a short time.

Source: IEEE/ACM International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP)

DOI: 10.1109/icse-seip66354.2025.00054

Authors: Ita Ryan, Utz Roedig, Klaas-Jan Stol

Institution: University College Cork

Language: English

Topic: Web Application Security Vulnerabilities

Subfield: Information Systems

Field: Computer Science

Domain: Physical Sciences

Open Access status: green

Funder: Science Foundation Ireland

Award: G2224769443