New Survey: 86% of Developers Do Not View Application Security As a Top Priority

Only 29% of developers believe that writing vulnerability-free code should be prioritized

Secure Code Warrior, the global, developer-driven security leader, released findings from its annual ‘The State of Developer-Driven Security’ 2022 survey, which found that developers’ actions and attitudes toward software security are in conflict. While many developers acknowledge the importance of applying a security-led approach in the software development lifecycle, 86% do not view application security as a top priority when writing code.

The research found that more than half of the 1200 developers surveyed are unable to ensure that their code is protected from seven common vulnerabilities. This is a contributing factor to another major finding – that only 29% of developers believe the active practice of writing code free of vulnerabilities should be prioritized.

Latest Fintech News: Dynasets: AI is Conquering the World of Crypto Investment

Despite developers and organizations recognizing that threats and vulnerabilities in key applications could have been mitigated earlier in the development process they continue to take reactive steps to address the flaws. Secure Code Warrior pursued this survey to assess how developers can take more proactive steps and be empowered to embrace effective secure coding practices.

Developers continue to face competing priorities and point to numerous management-related barriers that are preventing them from creating secure code earlier in the software development lifecycle. These are primarily due to time constraints to meet deadlines (24%), or developers not having enough training or guidance on how to implement secure coding from their managers (20%).

Training remains a major influence over developers’ application of secure coding as 81% are utilizing the knowledge gleaned from training on a near-daily basis. However, while many developers are utilizing training mechanisms on a daily basis, the research found that 67% are still knowingly shipping vulnerabilities in their code. The findings show that different training experiences are needed now more than ever. One out of four developers want more training guided by self-paced multimedia and one out of five believe training would be perceived as greatly improved if an industry certification was an outcome.

“Developers want to do the right thing, and while they are starting to care more about security, their working environment doesn’t always make it easy for them to make it a priority. Often, the tools at their disposal – and methods they are deploying – result in ‘getting by’, rather than actively reducing risk, and their priorities remain misaligned with the security team,” said Pieter Danhieux, Co-founder and CEO, Secure Code Warrior.

Latest Fintech News: EnKash Raises US$ 20 Million in an Ascent Capital-led Round, Joined by Baring India and White Ventures

“While organizations encourage secure coding practices, developers are unclear on how they are defined in their day-to-day work, and what is expected of them. To reach a higher standard of code quality, organizations must formalize secure coding standards as they apply to developers, and guide a change in behavior that reinforces good coding patterns and enables security at speed.”

The annual survey’s additional findings point to the ongoing hardships developers continue to face in their secure coding journey:

• 36% attribute the priority of meeting deadlines as a primary reason their coding still possesses vulnerabilities
• 33% don’t know what makes their code vulnerable
• 30% feel that their in-house security training could most be improved if it had more practical training with real world scenarios and outcomes
• 30% say the biggest concern with the implementation and practice of secure coding is dealing with vulnerabilities introduced by co-workers