This document discusses secure coding practices and software development lifecycles. It summarizes a survey conducted by Enterprise Management Associates (EMA) on secure coding. The survey found that 69% of organizations have software development lifecycles (SDLCs) that miss critical security steps, and only 87.6% train employees on secure coding practices. EMA believes the best approach is using code reviews, code scanning tools, and continuous third-party training. While a "shift left" security approach is effective, adopting any security model is better than the incomplete SDLCs used by many organizations.

1. | @ema_research
Secure Coding Practices –
Growing Success or Zero-
Day Epidemic?
Ken Buckler, CASP, Research Analyst
Information Security, Risk, and Compliance Management
Enterprise Management Associates
KBuckler@enterprisemanagement.com
Sponsored by

2. | @ema_research
| @ema_research
Featured Speaker
Ken has over 15 years of industry experience as a noted
information and cyber security practitioner, software developer,
author, and presenter, focusing on endpoint security and Federal
Information Security Management Act (FISMA) and NIST 800-53
compliance. Focusing on strict federal security standards, Ken has
consulted with numerous federal organizations, including Defense
Information Systems Agency (DISA), Department of Veterans
Affairs, and the Census Bureau.
He was previously board chair of The Mars Generation’s Student
Space Ambassador Leadership Program, an advisory board made
up of students and professional mentors focused on STEAM learning
and advocacy. His technical career started in the defense sector
as a quality assurance and information assurance engineer
contracted with the DISA Defense Message System (DMS),
eventually designing the top-level architecture of the Host-Based
Security System (HBSS) integration for the DMS global messaging
backbone. Ken has presented at industry conferences with his
research on early warning of cyber-attacks based on open-source
intelligence (OSINT).
© 2022 Enterprise Management Associates, Inc. 2
Ken Buckler
Research Director
Information Security, Risk and Compliance Management
Enterprise Management Associates
| @ema_research

3. | @ema_research
| @ema_research
Sponsor
© 2023 Enterprise Management Associates, Inc. 3

4. | @ema_research
Introduction

5. | @ema_research
| @ema_research
Introduction
© 2023 Enterprise Management Associates, Inc. 5
*CVSS Severity Distribution Over Time, https://nvd.nist.gov/general/visualizations/vulnerability-visualizations/cvss-severity-distribution-over-time
**Cable, Jack. “Security requirements for computer science degrees.” Aug 22, 2019. https://gist.github.com/cablej/f272747f2d545342aec7f34a1bfae4ef

6. | @ema_research
Introduction
© 2023 Enterprise Management Associates, Inc. 6
Software developers are not being taught
secure coding practices at colleges and
universities.

7. | @ema_research
Introduction
© 2023 Enterprise Management Associates, Inc. 7
A significant number of organizations are
failing to invest in any secure coding training
whatsoever.

8. | @ema_research
Introduction
© 2023 Enterprise Management Associates, Inc. 8
The growth in new vulnerabilities year after year
shows a clear skills gap when it comes to
secure coding.

9. | @ema_research
| @ema_research
Demographics – Primary Industry
© 2023 Enterprise Management Associates, Inc. 9

10. | @ema_research
Voices of the Survey
– Respondent
Quotes and
Feedback

11. | @ema_research
| @ema_research
Select Open-Ended Responses
Explain your organization’s approach to securing custom-developed applications: what has worked,
what hasn’t worked, and where you believe your organization, or the industry, needs to improve
© 2023 Enterprise Management Associates, Inc. 11
“Including good security practices early in the software
development process can avoid costly refactoring or potentially
catastrophic security breaches later in the application's lifecycle.”
Executive IT Leader
Computer/Tech Software Industry

12. | @ema_research
| @ema_research
Select Open-Ended Responses
Explain your organization’s approach to securing custom-developed applications: what has worked,
what hasn’t worked, and where you believe your organization, or the industry, needs to improve
© 2023 Enterprise Management Associates, Inc. 12
“It all comes down to good coders on your team. If you can get
the right people in there, then you should be ahead of any
intrusions. I think the industry just needs more development and
learning at the base.”
IT Director
Computer/Tech Services Industry

13. | @ema_research
| @ema_research
Select Open-Ended Responses
Explain your organization’s approach to securing custom-developed applications: what has worked,
what hasn’t worked, and where you believe your organization, or the industry, needs to improve
© 2023 Enterprise Management Associates, Inc. 13
“[Our approach is] rethinking security and integrating it into the
development process. The most common mistake in security is to
treat it as a single step in the process, when security should be
comprehensive and systematic.”
Development Director
Computer/Tech Services Industry

14. | @ema_research
Some interesting trends in responses…
of organizations have SDLCs that miss
critical security steps
69%
© 2023 Enterprise Management Associates, Inc. 14

15. | @ema_research
Some interesting trends in responses…
of organizations have adopted a “shift
left” security SDLC model, and 5% are
using a “legacy” security SDLC model
25%
© 2023 Enterprise Management Associates, Inc. 15

16. | @ema_research
Some interesting trends in responses…
© 2023 Enterprise Management Associates, Inc. 16
of organizations utilize code reviews for
secure coding, but only 87.6% train their
employees on secure coding practices
95%

17. | @ema_research
Some interesting trends in responses…
© 2023 Enterprise Management Associates, Inc. 17
of organizations using a combination of
code reviews, code-scanning tools, and
third-party training saw improvement in
their code security
100%

18. | @ema_research
Software
Development
Lifecycles

19. | @ema_research
| @ema_research
Software Development Lifecycles
© 2023 Enterprise Management Associates, Inc. 19

20. | @ema_research
Secure Coding
Practices

21. | @ema_research
| @ema_research
Secure Coding Practices
© 2023 Enterprise Management Associates, Inc. 21

22. | @ema_research
| @ema_research
Secure Coding Practices
© 2023 Enterprise Management Associates, Inc. 22

23. | @ema_research
| @ema_research
Secure Coding Practices
© 2023 Enterprise Management Associates, Inc. 23

24. | @ema_research
Measuring Results

25. | @ema_research
| @ema_research
Measuring Results – SDLC
© 2023 Enterprise Management Associates, Inc. 25

26. | @ema_research
| @ema_research
Measuring Results – Secure Coding
© 2023 Enterprise Management Associates, Inc. 26

27. | @ema_research
| @ema_research
Measuring Results – Secure Coding
© 2023 Enterprise Management Associates, Inc. 27

28. | @ema_research
| @ema_research
Measuring Results – Training
© 2023 Enterprise Management Associates, Inc. 28

29. | @ema_research
| @ema_research
Measuring Results – Training
© 2023 Enterprise Management Associates, Inc. 29

30. | @ema_research
Closing Thoughts

31. | @ema_research
Closing Thoughts
© 2023 Enterprise Management Associates, Inc. 31
EMA believes the best approach to secure
software development is a combination of code
reviews, code-scanning tools, and a stronger
emphasis on continuous third-party training.

32. | @ema_research
Closing Thoughts
© 2023 Enterprise Management Associates, Inc. 32
While a “shift left” approach does appear to be
more effective, even adopting a legacy security
model would be preferable to the incomplete
security SDLCs used by almost 70% of
organizations today.

33. | @ema_research
Closing Thoughts
© 2023 Enterprise Management Associates, Inc. 33
Third-party training appears to be the critical
component in which some organizations are
failing to invest.

34. | @ema_research
Closing Thoughts
© 2023 Enterprise Management Associates, Inc. 34
Across all industry verticals, software
development must shift its focus away from
heavily relying on code-scanning tools and
more on people and processes.

35. | @ema_research
| @ema_research
Questions? Contact Ken or Chris
Contact us:
Chris Steffen, CISSP, CISA - linkedin.com/in/chrissteffen
Ken Buckler, CASP - linkedin.com/in/ken-buckler
Download the report:
https://www.enterprisemanagement.com/research/asset.php/4241/
Secure-Coding-Practices-%96-Growing-Success-or-Zero-Day-
Epidemic
Be sure to visit:
https://www.securityjourney.com/ to learn about Security Journey’s
ability to help developers and the entire SDLC team recognize and
understand vulnerabilities and threats and proactively mitigate risks
© 2023 Enterprise Management Associates, Inc. 35