86% of developers don’t prioritize application security

Secure Code Warrior released findings from its survey, which found that developers’ actions and attitudes toward software security are in conflict. While many developers acknowledge the importance of applying a security-led approach in the software development lifecycle, 86% do not view application security as a top priority when writing code.

The research found that more than half of the 1200 developers surveyed are unable to ensure that their code is protected from seven common vulnerabilities. This is a contributing factor to another major finding – that only 29% of developers believe the active practice of writing code free of vulnerabilities should be prioritized.

Despite developers and organizations recognizing that threats and vulnerabilities in key applications could have been mitigated earlier in the development process they continue to take reactive steps to address the flaws.

Developers continue to face competing priorities and point to numerous management-related barriers that are preventing them from creating secure code earlier in the software development lifecycle. These are primarily due to time constraints to meet deadlines (24%), or developers not having enough training or guidance on how to implement secure coding from their managers (20%).

Different training experiences are needed now more than ever

Training remains a major influence over developers’ application of secure coding as 81% are utilizing the knowledge gleaned from training on a near-daily basis. However, while many developers are utilizing training mechanisms on a daily basis, the research found that 67% are still knowingly shipping vulnerabilities in their code.

One out of four developers want more training guided by self-paced multimedia and one out of five believe training would be perceived as greatly improved if an industry certification was an outcome.

“Developers want to do the right thing, and while they are starting to care more about security, their working environment doesn’t always make it easy for them to make it a priority. Often, the tools at their disposal – and methods they are deploying – result in ‘getting by’, rather than actively reducing risk, and their priorities remain misaligned with the security team,” said Pieter Danhieux, CEO, Secure Code Warrior.

“While organizations encourage secure coding practices, developers are unclear on how they are defined in their day-to-day work, and what is expected of them. To reach a higher standard of code quality, organizations must formalize secure coding standards as they apply to developers, and guide a change in behavior that reinforces good coding patterns and enables security at speed.”

Additional findings point to the ongoing hardships developers continue to face in their secure coding journey:

• 36% attribute the priority of meeting deadlines as a primary reason their coding still possesses vulnerabilities
• 33% don’t know what makes their code vulnerable
• 30% feel that their in-house security training could most be improved if it had more practical training with real world scenarios and outcomes
• 30% say the biggest concern with the implementation and practice of secure coding is dealing with vulnerabilities introduced by co-workers