Secure software development: Why the development world awoke to the challenge

Abstract

From the beginning of the information security age 20 years ago, CIOs have asked over and over, “when will programmers stop making security mistakes?” But other than highly visible efforts by a few large software vendors, the software development community has not heard the question. At least they have not responded until now. More than 40 large organizations, from Tata Consulting Services (the largest outsourcer in India) to Intel, from Boeing to Siemens, have joined together to raise the visibility of secure software development – and they are having an impact. This article chronicles the forces that brought the consortium together and the steps that they have taken to improve the practice of secure coding throughout the development lifecycle.