What is it about?
Modern software systems are complex, and without the right security mindset they can easily have security problems. Researchers and tool vendors have proposed many security-oriented approaches, but we still know little about how companies organize security testing in practice. In this paper, we interviewed 19 security experts to understand how companies set up the security testing process and how it is actually performed.
Featured Image
Photo by FlyD on Unsplash
Why is it important?
Some companies include a dedicated security tester role in the software life cycle, but practitioners report a lack of standardized guidelines for security testing. From a management point of view, our results suggest that formal communication between development and security testing teams may lead to better performance.
Perspectives
Security is often discussed in terms of tools, but less is known about how companies organize security testing in practice. We interviewed 19 security experts to find out. One finding I consider useful for managers: practitioners lack standardized guidelines, and better communication between development and security testing teams may lead to better results.
Prof. Stefano Lambiase
Aalborg Universitet
Read the Original
This page is a summary of: Security Testing in The Wild: An Interview Study, September 2023, Institute of Electrical & Electronics Engineers (IEEE),
DOI: 10.1109/seaa60479.2023.00037.
You can read the full text:
Contributors
The following have contributed to this page
