# Security Monitoring during Software Development:
## 3 Methodology
### Core Findings  
In the present section, we provide the core findings of the previously described two-step survey and focus group. For reasons of brevity, only the main findings that were considered important for the design and development of the VM4 SEC platform are presented and summarized. In Figures 2 and 3, we provide the demographics of the participants that were involved both in the two-step survey and in the focus group, as gathered by the questionnaire. As can be seen in Figure 2, the vast majority of the participants (i.e., 50%) were actual developers, followed by Quality Assurance (QA) Engineers (i.e., 19%), 13% were project managers, and the remaining percentage (i.e., 6%) was equally distributed among software engineers, software architects, and DevOps engineers. Hence, we have representatives from the whole SDLC, whereas the main body of the responses stems from people that are actively involved in the actual development of the software projects. In addition to this, as can be seen in Figure 3, 56.3% of the participants have less than 5 years of working experience, while 12.5% have more than 10 years of working experience. **Focus Group Structure**  
**Block 1: Current state of security of the company**  
* Do you use re-active security countermeasures in your software projects? If yes, which are the most commonly used? * Do you used pro-active security testing/monitoring mechanisms? If yes, which are the most commonly used? * Do you prefer static or dynamic security testing and why? Are there any shortcomings with those techniques that you would like to improve? **Block 2: Security Monitoring Needs**  
* Are you aware of any novel security monitoring and optimization solution that you believe that it would be worth being added to your pipeline? * Do you think that having quantitative security metrics is useful? * Do you think that having vulnerability prediction is useful? * Do you think that having ML-based fuzz testing is useful? * Do you think that having ML-based penetration testing is useful? **Block 3: Security Monitoring Platform Functionality and Usability**  
* What functionalities should a security monitoring platform have? * What additional features should be provided in order to improve the usability and the practicality of the security monitoring platform? * What qualities should the platform exhibit? (e.g., number of concurrent users, acceptable down time)
* What are the most useful scenarios that you can think of? **Block 4: Parameterization of the selected monitoring mechanisms**  
* Which security characteristics are more important for your projects? * Which security issues are more critical and commonly found in your software projects? * Which of these issues affect each one of the security characteristics of interest? **Block 5: Conclusion**  
* Thank you for your time
* Explain next steps (...)
* Ask if they would like to receive results by email. **Figure 2. Industrial Case Study Demographics—Participants’ Role in the Company. **  
**SURVEY:** Figure 4 presents the results of Q2.1 regarding the type of security testing (i.e., pro-active or re-active) the participants use during their SDLC. As can be seen, the vast majority of the participants stated that they use security testing approaches in their projects in order to enhance security. Among the re-active approaches (Q2.2), vulnerability patching and installation of firewall are the most widely used, followed by attack detection techniques and honeypots, as shown in Figure 5. An interesting observation is that around 31% of the respondents said that they do not normally apply re-active approaches in their projects. This was an engaging finding that was marked as a point for discussion in the focus group, in order to better understand the reasons why in some projects no re-active approaches are adopted.