‘Follow the Money. Or Jail Time.’ Perspectives on the Role of Senior Management in Secure Software Development

The number of recorded vulnerabilities in software continues to rise, despite attempts to improve secure coding practice. Much software security research focuses on software developers’ abilities, tools and motivations. However, software security budgets and priorities ultimately derive from an organisation's senior management. There is little research on senior management's understanding of software security. We interviewed 21 professional developers, managers and consultants to assess perceptions of how management priorities shape software security in organisations. We found that management priorities are important in providing the resources needed for secure software development. Software-security understanding can be lacking in senior management, which, along with budget pressures, can affect its prioritisation. Developers can be self-motivated to code securely despite lack of management support. Disturbingly, some senior managers will actively subvert software security. Acquisitions, divestitures, downsizing, and funding issues may affect an organisation's software security stance. We make a number of recommendations for policymakers, the C-suite and other stakeholders, and suggest directions for further research.