Implementing and integrating security controls: A practitioners’ perspective

Security controls are indispensable in today’s technology-driven world for their essential role in protecting applications and systems in many organizations. They help to manage the organizational controls to ensure confidentiality, integrity and access to vital infrastructure and data (e.g., software applications, financial records, personal information, intellectual property, etc.) by ensuring that only authorized and trustworthy users have privileged access. Further, integrating security controls within the Software Development Lifecycle (SDLC) is imperative for detecting application deficiencies and preventing potential breaches that could result in financial losses and expose the systems to external and/or internal threats. They reduce the exploitation risk by identifying and patching vulnerabilities in applications and networks within the organization. To explore and get in-depth insights, a survey was conducted with 118 software practitioners to determine how they embed and handle security controls in software development environments. Our survey covers the four phases of the security controls lifecycle, including classifying, identifying, implementing, and validating security controls to understand the best practices and essential activities in each process. The survey results indicated that most respondents recognized the critical importance of understanding security requirements prior to integrating appropriate security controls in each software release. We highlighted key factors that influence the selection and identification of security controls, including user group considerations, risk management practices, and organizational requirements. It appeared that security practitioners utilize a wide range of security controls that are broadly classified into six categories, where administrative and technical controls come first. With this emphasis and awareness, they could align their responses with practical and contextual factors driving effective security control implementation. Furthermore, the findings showed that most organizations rely on internal departments to implement and maintain security controls in conjunction with continuous security practices throughout the different phases of the SDLC. In contrast, only 36% of respondents utilize automated testing tools for monitoring, while 52% cite insufficient security training as a major obstacle. The survey highlighted the need to hire skillful security practitioners who possess a diverse range of cybersecurity skills, enabling them to govern security controls and handle troubleshooting with poise and professionalism, taking advantage of lessons learned in past experiences. The results also demonstrated the need for employing up-to-date tools and carrying out a list of best practices, to implement security controls and improve their effectiveness for the purpose of up-leveling the overall security posture. Those results emphasize the need for enhanced training programs and advanced tools to streamline security control integration. In addition, this study provides actionable insights for improving compliance and risk management, contributing to a more robust, comprehensive cybersecurity framework.