First-time Security Audits as a Turning Point?: Challenges for Security
Practices in an Industry Software Development Team
Late-Breaking Works: Collaborative Technologies
/
Poller, Andreas
/
Kocksch, Laura
/
Kinder-Kurlanda, Katharina
/
Epp, Felix Anand
Extended Abstracts of the ACM CHI'16 Conference on Human Factors in
Computing Systems
2016-05-07
v.2
p.1288-1294
© Copyright 2016 ACM
Summary: Software development is often accompanied by security audits such as
penetration tests, usually performed on behalf of the software vendor. In
penetration tests security experts identify entry points for attacks in a
software product. Many development teams undergo such audits for the first time
if their product is attacked or faces new security concerns. The audits often
serve as an eye-opener for development teams: they realize that security
requires much more attention. However, there is a lack of clarity with regard
to what lasting benefits developers can reap from penetration tests. We report
from a one-year study of a penetration test run at a major software vendor, and
describe how a software development team managed to incorporate the test
findings. Results suggest that penetration tests improve developers' security
awareness, but that long-lasting enhancements of development practices are
hampered by a lack of dedicated security stakeholders and if security is not
properly reflected in the communicative and collaborative structures of the
organization.
