# Security Monitoring during Software Development:
## 3 Methodology
### Core Findings
As will be discussed later in the focus group, these participants stated that they did not use re-active security approaches, as the software products that were working on did not have security concerns, and therefore the installation of security countermeasures was not considered necessary. **Do you use security countermeasures (either**  
pro-active or re-active) during the SDLC? **  
Figure 4: Adoption of Security Mechanisms by the Company. Figure 3: Industrial Case Study Demographics—Participants’ Years of Experience. In Figure 6, the results of Q2.3 with respect to the kind of pro-active approaches used by the Company during the SDLC are presented. As can be seen, around 69% of the participants stated that they employ dynamic security testing, followed by static testing, which was selected by around 31% of the participants. Around 19% of the participants stated that they do not utilize any pro-active security testing approach, either static or dynamic, during the overall development process. Similarly to Q2.2, as revealed during the focus group, the reason for not using pro-active security testing approaches was that the referred software products were not security-critical. In Q2.4, the participants were asked to declare which one of the pro-active security approaches they consider useful, and therefore should receive more attention from the development team. As can be seen in Figure 7, around 75% of the participants stated that static analysis is considered the most promising security testing technique during the coding phase and therefore, deserves more attention from the Company. This contradicts the low utilization of static analysis for security purposes by the Company, which was observed in the responses of Q2.3. An interesting topic for discussion, which was left for the focus group, was to understand whether the participants selected static analysis because they find it indeed useful and helpful for adding security to their systems, or because they recognize that it is not widely used during their pipelines. Figure 5: Adoption of Re-active Security Mechanisms by the Company. Figure 6: Adoption of Pro-active Security Mechanisms by the Company. In Q2.5, the participants were asked which novel security monitoring mechanisms (from a given set) they consider to be interesting and with practical value, in order to be included in their pipelines. A summary of their responses is illustrated in Figure 8. As can be seen, the static-analysis-based security monitoring mechanisms, namely the quantitative security assessment (QSA) and the vulnerability prediction models (VPMs), were recognized as the most valuable ones, taking up around 88% and 94% of the votes, respectively. By analyzing the responses presented above, we reached the conclusion that the participants are more interested in security monitoring mechanisms that are based on static code analysis, and particularly on the QSA and VPMs mechanisms. Based on this observation, as already discussed in \"Two-Step Survey\", the questions of Part 3 and Part 4 of the questionnaire were properly defined (see Table 2), in order to collect information necessary for configuring/tuning those mechanisms. For reasons of brevity, we provide the main findings of these questions. According to the participants' responses, the security characteristics of _Confidentiality_, _Availability_, and _Integrity_ were considered the most important security aspects of their software products. In addition to this, the security issues that greatly affect each one of these security character  
Figure 8: Novel Security Monitoring Solutions that are of High Interest for the Company. Figure 7: Pro-active Security Mechanisms of High Interest for the Company. istics was identified. The most critical security issues that were identified were the _Null Pointer_ references. More information on how these results were leveraged is provided in Section 3.3, where the models are constructed.