Establishing Performance Baselines for Secure Software Development

The COVID‐19 pandemic has impacted the world, prompting a shift toward remote work and stay‐at‐home economies, altering routines for individuals and businesses. Organizations have had to swiftly implement digital solutions to enable productive and efficient remote work, a trend that is becoming increasingly common. In this context, enterprise programmers often rely on open‐source software from social platforms to accelerate application development. However, the source code on these platforms may not always be regularly updated or well‐maintained, posing security risks. These risks are exacerbated when programmers need more security software‐focused development practices, testing for vulnerabilities, or applying necessary patches regularly. This study introduces two secure software development (SSD) performance baselines based on international standards and utilizing statistical process control (SPC): proactive information security awareness and reactive risk management. These baselines enable enterprise IT departments to monitor security awareness and improve the secure development capabilities of programmers and R&D teams, thereby mitigating the security risks of released software. A practical case study is presented to demonstrate the effectiveness of this approach.