Software security depends on the developers' motivations and deterrents

Authors:

  • Henrik Karlzén
  • Jerry Falkcrona
  • Daniel Eidenskog
  • Martin Karresand

Publish date: 2024-12-16

Report number: FOI-R--5691--SE

Pages: 43

Written in: Swedish

Keywords:

  • software
  • security
  • motivator
  • deterrent
  • survey

Abstract

The security level of Swedish software does not measure up, as shown by several incidents in societally critical IT systems, resulting in potentially severe consequences. There are many interacting reasons for software not being secure enough, including the security-related motivators and deterrents of software developers. Understanding these motivators and deterrents is an important step to increasing the security level of software. This report presents the results from a survey on software developers' motivators and deterrents related to software security. The survey is based on a previous North American survey. The survey was filled out by software developers working with societally critical IT systems in Swedish authorities and companies. The results show that the strongest motivators are internal to the developer and relate to developer responsibility and awareness. The external motivators, originating from others, are weaker but include, among others, mandatory security practices and organisational culture. Deterrents are generally assessed as having a smaller impact than the motivators. The highest ranked deterrents include that limited competition makes security feel less important, and that the developer is not blamed for vulnerabilities that occur. Other relatively important deterrents include low priority and lack of financial resources concerning software security.