Exploring the Impact of Software Security Best Practices

Organizations delivering digital services and products to their customers are facing a number of different challenges due to the evolving landscape of cyber threats. To overcome these challenges, an increasing number of these firms are investing in secure software development. This research study explores the impact of the following software security best practices on software product security and quality. For this purpose, first, an online survey is conducted in the Pakistani software industry to determine the most commonly used software security best practices. Based on the information obtained from this survey (34 responses from 32 different organizations), it is found that some of the most widely used software security practices are Authentication, Authorization, and Accountability; Secure Deployment Environment; Application Programming Interface (API) and Component Security Testing; and Error Handling Mechanism and Logging. Next, an industrial experiment is designed and conducted to determine the impact of these practices on real-world projects. Keeping practical considerations in mind, 5 of the top most widely-used security best practices are shortlisted for this experiment and 3 different software development companies are engaged. Before starting the experiment, training on these shortlisted security best practices is also provided to the representatives of these companies. Software quality and software size data of two consecutive sprints – sprint n (without security best practices) and sprint n+1 (with security best practices) – is collected from each of these 3 companies. Metrics such as weighted defect density and weighted security defect density are calculated for both sprints. A comparative analysis reveals a significant improvement in software security and overall software quality in sprint n+1 vis á vis sprint n.