teams or projects to ensure a high level of security at an early stage in the
SDLC.

## References

  * [1] K. Simon.  The value of open standards and open-source software in government environments.  IBM Systems Journal, 44:227 – 238, 02 2005.
  * [2] Manfred Broy, Florian Deissenboeck, and Markus Pizka.  Demystifying maintainability.  In Proceedings of the 2006 International Workshop on Software Quality, WoSQ ’06, page 21–26, New York, NY, USA, 2006. Association for Computing Machinery.
  * [3] Cenk Aksoy.  Critical success factors for cybersecurity just technical? exploring the role of human factors in cybersecurity management.  06 2023.
  * [4] Tore Dybå and Torgeir Dingsøyr.  What do we know about agile software development?  Software, IEEE, 26:6 – 9, 11 2009.
  * [5] Arina Kudriavtseva and Olga Gadyatskaya.  Secure software development methodologies: A multivocal literature review.  11 2022.
  * [6] Mamdouh Alenezi and Sadiq Almuairfi.  Essential activities for secure software development.  International Journal of Software Engineering and Applications, 11:1–14, 03 2020.
  * [7] Synopsys Inc.  Synopsys.com.  Last Access: Nov. 2023.
  * [8] Dan Bergh Johnsson, Daniel Deogun, and Daniel Sawano.  Secure By Design.  Manning, 2019.
  * [9] The Open Group.  Security architecture and the adm.  https://pubs.opengroup.org/architecture/togaf91-doc/arch/chap21.html, 2011.  last accessed: 13.10.2023.
  * [10] P. Salini and S. Kanmani.  Survey and analysis on security requirements engineering.  Computers and Electrical Engineering, 38(6):1785–1797, 2012.
  * [11] Rafiq Ahmad Khan, Siffat Ullah Khan, Habib Ullah Khan, and Muhammad Ilyas.  Systematic literature review on security risks and its practices in secure software development.  IEEE Access, 10:5456–5481, 2022.
  * [12] Nancy R. Mead and Ted Stehney.  Security quality requirements engineering (square) methodology.  SIGSOFT Softw. Eng. Notes, 30(4):1–7, 2005.
  * [13] Charles Haley, Jonathan Moffett, Robin Laney, and Bashar Nuseibeh.  A framework for security requirements engineering.  05 2006.
  * [14] Gustav Boström, Jaana Väyrynen, Marine Bodén, Konstantin Beznosov, and Philippe Kruchten.  Extending xp practices to support security requirements engineering.  pages 11–18, 05 2006.
  * [15] Dan Graham.  Introduction to the clasp process.  Build Security In, 2006.
  * [16] Steve Lipner.  The trustworthy computing security development lifecycle.  pages 2– 13, 01 2005.
  * [17] Daniel Mellado, Eduardo Fernández-Medina, and Mario Piattini.  A common criteria based security requirements engineering process for the development of secure information systems.  Computer Standards and Interfaces, 29(2):244–253, 2007.
  * [18] HARALAMBOS MOURATIDIS and PAOLO GIORGINI.  Secure tropos: A security-oriented extension of the tropos methodology.  International Journal of Software Engineering and Knowledge Engineering, 17(02):285–309, 2007.
  * [19] Bart De Win, Riccardo Scandariato, Koen Buyens, Johan Grégoire, and Wouter Joosen.  On the secure software development process: Clasp, sdl and touchpoints compared.  Information and Software Technology, 51(7):1152–1171, 2009.  Special Section: Software Engineering for Secure Systems.
  * [20] Wenjun Xiong and Robert Lagerström.  Threat modeling – a systematic literature review.  Computers and Security, 84:53–69, 2019.
  * [21] Hassan El-Hadary and Sherif El-Kassas.  Capturing security requirements for software systems.  Journal of Advanced Research, 5(4):463–472, 2014.  Cyber Security.
  * [22] A. Apvrille and M. Pourzandi.  Secure software development by example.  IEEE Security and Privacy, 3(4):10–17, 2005.
  * [23] Didit Suprihanto, Retantyo Wardoyo, and Khabib Mustofa.  Determination of weighting assessment on dread model using profile matching.  International Journal of Advanced Computer Science and Applications, 9(10):68–72, 2018.
  * [24] Laurie Williams, Gary McGraw, and Sammy Migues.  Engineering security vulnerability prevention, detection, and response.  IEEE Software, 35(5):76–80, 2018.
  * [25] Hernan Nina, José Antonio Pow-Sang, and Mónica Villavicencio.  Systematic mapping of the literature on secure software development.  IEEE Access, 9:36852–36867, 2021.
  * [26] National Institute of Standards and Technology.  National vulnerability database.  Last Access: Nov. 2023.
  * [27] The MITRE Corporation.  Cve.  Last Access: Nov. 2023.
  * [28] The MITRE Corporation.  Common weakness enumeration.  Last Access: Nov. 2023.
  * [29] Jamie O’Hare, Rich Macfarlane, and Owen Lo.  Identifying vulnerabilities using internet-wide scanning data.  In 2019 IEEE 12th International Conference on Global Security, Safety and Sustainability (ICGS3), pages 1–10, 2019.
  * [30] B. Arkin, S. Stender, and G. McGraw.  Software penetration testing.  IEEE Security and Privacy, 3(1):84–87, 2005.
  * [31] Matt Bishop.  About penetration testing.  IEEE Security and Privacy, 5(6):84–87, 2007.
  * [32] George Klees, Andrew Ruef, Benji Cooper, Shiyi Wei, and Michael Hicks.  Evaluating fuzz testing.  CCS ’18, page 2123–2138, New York, NY, USA, 2018. Association for Computing Machinery.
  * [33] Ivo Gomes, Pedro Morgado, Tiago Gomes, and Rodrigo Moreira.  An overview on the static code analysis approach in software development.  Faculdade de Engenharia da Universidade do Porto, Portugal, 2009.
  * [34] Alexandru G Bardas et al.  Static code analysis.  Journal of Information Systems and Operations Management, 4(2):99–107, 2010.
  * [35] Alissa Torres.  Incident response: How to fight back.  SANS Institute InfoSec Reading Room, 2014.
  * [36] Robin Ruefle.  The role of computer security incident response teams in the software development life cycle.  Technical Report AD1180041, Carnegie Mellon University, 8725 John J. Kingman Road, Fort Belvoir, VA 22060-6218, 2007.
  * [37] Nesara Dissanayake, Asangi Jayatilaka, Mansooreh Zahedi, and M. Ali Babar.  Software security patch management - a systematic literature review of challenges, approaches, tools and practices.  Information and Software Technology, 144:106771, 2022.
  * [38] Armando Ramirez, Anthony Aiello, and Susan J Lincke.  A survey and comparison of secure software development standards.  In 2020 13th CMI Conference on Cybersecurity and Privacy (CMI) - Digital Transformation - Potentials and Challenges(51275), pages 1–6, 2020.
  * [39] Bundesamt für Sicherheit in der Informationstechnik.  Iso 27001 zertifizierung auf basis von it-grundschutz.  Last Access: Nov. 2023.
  * [40] Inc. OWASP Foundation.  Owasp.  Last Access: Nov. 2023.
  * [41] Bundesamt für Sicherheit in der Informationstechnik.  Common criteria (cc) iso/iec 15408:2022.  Last Access: Nov. 2023.
  * [42] C. Robson.  Real World Research: A Resource for Users of Social Research Methods in Applied Settings.  Wiley, 2011.
  * [43] Philipp Mayring.  Qualitative inhaltsanalyse, volume 14.  UVK Univ.-Verl. Konstanz, 1994.
  * [44] Anselm Strauss and Juliet Corbin.  Grounded theory methodology: An overview.  1994\.

##  Appendix A Interview 1

Category |  Interview 1 Information
---|---
Role of the person |  Architect
Size of the Company |  1001 - 5000
Size of Development Team |  -
Duration of Software Development |  <14
Target Market |  Finance
Type of Software |  Web
Development Methode |  Agile; Waterfall
Importance of Security |  Highest
Evolution of Importance |  Constant
Identification of Requirements |  Implicit
Timeing of Analysis |  Analysis
Response to Changes |  Iterative
External Standards |  OWASP; BSI; Industry Specific
Internal Standards |  Without
External Software Usage |  Whitelist; Dedicated; Support
Security Assessment |  Comp; EA; R; A
Incident Handling |  CI; Hot; FR; FP
Challenges |  CX; Costs
Handling of Challenges |  Awareness

##  Appendix B Interview 2

Category |  Interview 2 Information
---|---
Role of the person |  Architect
Size of the Company |  <500
Size of Development Team |  -
Duration of Software Development |  <14
Target Market |  Online Commerce
Type of Software |  Infrastructure
Development Methode |  Agile
Importance of Security |  Equivalent
Evolution of Importance |  Constant
Identification of Requirements |  Dedicated
Timeing of Analysis |  Analysis
Response to Changes |  Analysis
External Standards |  ISO
Internal Standards |  With
External Software Usage |  Implicit
Security Assessment |  CA; CVE; Comp; A
Incident Handling |  CI; Hot; FR; Pol; FP
Challenges |  CX; RD
Handling of Challenges |  Good; Awareness

##  Appendix C Interview 3

Category |  Interview 3 Information
---|---
Role of the person |  Lead
Size of the Company |  500 - 1000
Size of Development Team |  -
Duration of Software Development |  >30
Target Market |  Infrastructure
Type of Software |  Web; Devices
Development Methode |  Agile; Waterfall
Importance of Security |  Equivalent
Evolution of Importance |  Increasing
Identification of Requirements |  Implicit
Timeing of Analysis |  Development
Response to Changes |  -
External Standards |  ISO; OWASP
Internal Standards |  Without
External Software Usage |  Dedicated
Security Assessment |  CA; CVE; Pen; SBOM; R; A
Incident Handling |  CI; Hot
Challenges |  CX
Handling of Challenges |  Good; Awareness

##  Appendix D Interview 4

Category |  Interview 4 Information
---|---
Role of the person |  Development
Size of the Company |  >5000
Size of Development Team |  8 - 10
Duration of Software Development |  14 - 25
Target Market |  Marketing
Type of Software |  CMS
Development Methode |  Agile
Importance of Security |  Equivalent
Evolution of Importance |  Increasing
Identification of Requirements |  Dedicated
Timeing of Analysis |  Development
Response to Changes |  Analysis
External Standards |  ISO; Client
Internal Standards |  Without
External Software Usage |  Implicit
Security Assessment |  CA
Incident Handling |  Hot
Challenges |  Tools; Aw
Handling of Challenges |  Awareness

##  Appendix E Interview 5

Category |  Interview 5 Information
---|---
Role of the person |  Lead
Size of the Company |  >5000
Size of Development Team |  -
Duration of Software Development |  -
Target Market |  Mobility
Type of Software |  Web; Devices
Development Methode |  Agile
Importance of Security |  Highest
Evolution of Importance |  Constant
Identification of Requirements |  Dedicated
Timeing of Analysis |  Analysis
Response to Changes |  Iterative
External Standards |  ISO; Industry Specific
Internal Standards |  Without
External Software Usage |  Dedicated
Security Assessment |  CVE; Pen; TM; EA; R; A
Incident Handling |  CI; Hot; FR; CP; FP
Challenges |  Aw; CL
Handling of Challenges |  Good; Development

##  Appendix F Interview 6

Category |  Interview 6 Information
---|---
Role of the person |  Development
Size of the Company |  500 - 1000
Size of Development Team |  11 - 12
Duration of Software Development |  >30
Target Market |  Infrastructure
Type of Software |  Web; Devices
Development Methode |  Agile
Importance of Security |  Highest
Evolution of Importance |  Increasing
Identification of Requirements |  Implicit
Timeing of Analysis |  Development
Response to Changes |  Iterative
External Standards |  ISO; Industry Specific
Internal Standards |  Without
External Software Usage |  Support; Implicit
Security Assessment |  CVE; Comp; A
Incident Handling |  CI
Challenges |  CX; Exp; Aw
Handling of Challenges |  Good; Development

##  Appendix G Interview 7

Category |  Interview 7 Information
---|---
Role of the person |  Development
Size of the Company |  500 - 1000
Size of Development Team |  8 - 10
Duration of Software Development |  >30
Target Market |  Infrastructure
Type of Software |  Web; Devices
Development Methode |  Agile
Importance of Security |  Equivalent
Evolution of Importance |  Increasing
Identification of Requirements |  Implicit
Timeing of Analysis |  Development
Response to Changes |  Iterative
External Standards |  -
Internal Standards |  Without
External Software Usage |  -
Security Assessment |  CVE; Pen; Comp
Incident Handling |  CI; FP
Challenges |  CX; Exp; Aw
Handling of Challenges |  Good; Development

##  Appendix H Interview 8

Category |  Interview 8 Information
---|---
Role of the person |  Architect
Size of the Company |  500 - 1000
Size of Development Team |  8 - 10
Duration of Software Development |  26 - 30
Target Market |  Mixed
Type of Software |  Web
Development Methode |  Agile
Importance of Security |  Subordinate
Evolution of Importance |  Increasing
Identification of Requirements |  Intuitive
Timeing of Analysis |  Iterative
Response to Changes |  Iterative
External Standards |  Client
Internal Standards |  Without
External Software Usage |  -
Security Assessment |  CA
Incident Handling |  CI; Hot; AU
Challenges |  CX; Cost; Tools
Handling of Challenges |  Good; Development

##  Appendix I Interview 9

Category |  Interview 9 Information
---|---
Role of the person |  Lead
Size of the Company |  1001 - 5000
Size of Development Team |  11 - 12
Duration of Software Development |  26 - 30
Target Market |  Industry
Type of Software |  App
Development Methode |  Agile; Waterfall
Importance of Security |  Equivalent
Evolution of Importance |  Increasing
Identification of Requirements |  -
Timeing of Analysis |  -
Response to Changes |  Analysis
External Standards |  -
Internal Standards |  Without
External Software Usage |  Whitelist; Dedicated
Security Assessment |  EA
Incident Handling |  CI; Hot; FP
Challenges |  Exp
Handling of Challenges |  Good; Development

##  Appendix J Interview 10

Category |  Interview 10 Information
---|---
Role of the person |  Architect
Size of the Company |  >5000
Size of Development Team |  >12
Duration of Software Development |  -
Target Market |  Mobility
Type of Software |  Web; Devices
Development Methode |  Agile
Importance of Security |  Highest
Evolution of Importance |  Increasing
Identification of Requirements |  Dedicated
Timeing of Analysis |  Analysis
Response to Changes |  Iterative
External Standards |  Industry Specific
Internal Standards |  Without
External Software Usage |  Dedicated
Security Assessment |  CVE; Pen; EA; R; A
Incident Handling |  CI; Hot; FR; CP; FP
Challenges |  CL
Handling of Challenges |  Good; Awareness

##  Appendix K Interview 11

Category |  Interview 11 Information
---|---
Role of the person |  Lead
Size of the Company |  <500
Size of Development Team |  11 - 12
Duration of Software Development |  14 - 25
Target Market |  Mobility
Type of Software |  Mixed
Development Methode |  Agile
Importance of Security |  Subordinate
Evolution of Importance |  -
Identification of Requirements |  Intuitive
Timeing of Analysis |  Iterative
Response to Changes |  Iterative
External Standards |  OWASP
Internal Standards |  Without
External Software Usage |  Implicit
Security Assessment |  CA; CVE; Pen; TM; R; A
Incident Handling |  CP; FP
Challenges |  Aw; Tools
Handling of Challenges |  Good; Awareness

##  Appendix L Interview 12

Category |  Interview 12 Information
---|---
Role of the person |  Architect
Size of the Company |  >5000
Size of Development Team |  >12
Duration of Software Development |  <14
Target Market |  Mixed
Type of Software |  Mixed
Development Methode |  Agile
Importance of Security |  Equivalent
Evolution of Importance |  Constant
Identification of Requirements |  Intuitive
Timeing of Analysis |  Iterative
Response to Changes |  Iterative
External Standards |  ISO
Internal Standards |  Without
External Software Usage |  Implicit
Security Assessment |  CA; CVE; Comp; EA; R
Incident Handling |  CI; Hot; CP
Challenges |  Aw; CL
Handling of Challenges |  Good; Development

##  Appendix M Interview 13

Category |  Interview 13 Information
---|---
Role of the person |  Development
Size of the Company |  1001 - 5000
Size of Development Team |  >12
Duration of Software Development |  <14
Target Market |  Finance
Type of Software |  Web
Development Methode |  Agile
Importance of Security |  Highest
Evolution of Importance |  Increasing
Identification of Requirements |  Implicit
Timeing of Analysis |  Iterative
Response to Changes |  Iterative
External Standards |  OWASP; Industry Specific
Internal Standards |  With
External Software Usage |  Implicit
Security Assessment |  CA; CVE; Pen; R; A
Incident Handling |  CI; Hot
Challenges |  CX; RD; Tools
Handling of Challenges |  Good; Awareness

##  Appendix N Interview 14

Category |  Interview 14 Information
---|---
Role of the person |  Lead
Size of the Company |  <500
Size of Development Team |  <8
Duration of Software Development |  14 - 25
Target Market |  Mixed
Type of Software |  Web
Development Methode |  Agile
Importance of Security |  Equivalent
Evolution of Importance |  Increasing
Identification of Requirements |  Dedicated; Client
Timeing of Analysis |  Analysis
Response to Changes |  Iterative
External Standards |  ISO
Internal Standards |  With
External Software Usage |  Implicit
Security Assessment |  CA; CVE; Pen; TM; R; A
Incident Handling |  CI; Hot; AU
Challenges |  RD; CL; Attacks
Handling of Challenges |  Awareness

##  Appendix O Interview 15

Category |  Interview 15 Information
---|---
Role of the person |  Architect
Size of the Company |  <500
Size of Development Team |  11 - 12
Duration of Software Development |  14 - 25
Target Market |  Mobility
Type of Software |  Mixed
Development Methode |  Agile
Importance of Security |  Equivalent
Evolution of Importance |  Increasing
Identification of Requirements |  Dedicated
Timeing of Analysis |  Analysis
Response to Changes |  Iterative
External Standards |  ISO
Internal Standards |  -
External Software Usage |  -
Security Assessment |  CA; Pen; Comp; TM
Incident Handling |  -
Challenges |  CP
Handling of Challenges |  Development

##  Appendix P Interview 16

Category |  Interview 16 Information
---|---
Role of the person |  Lead
Size of the Company |  >5000
Size of Development Team |  -
Duration of Software Development |  26 - 30
Target Market |  Mixed
Type of Software |  Mixed
Development Methode |  Agile
Importance of Security |  Equivalent
Evolution of Importance |  Increasing
Identification of Requirements |  Client
Timeing of Analysis |  Analysis
Response to Changes |  Iterative
External Standards |  ISO; Industry Specific
Internal Standards |  With
External Software Usage |  Dedicated
Security Assessment |  CA; CVE; Pen; R; A
Incident Handling |  CI; Hot; Pol; FP
Challenges |  Aw; CL
Handling of Challenges |  Awareness

##  Appendix Q Interview 17

Category |  Interview 17 Information
---|---
Role of the person |  Development
Size of the Company |  <500
Size of Development Team |  <8
Duration of Software Development |  <14
Target Market |  Mixed
Type of Software |  Web
Development Methode |  Agile
Importance of Security |  Equivalent
Evolution of Importance |  Increasing
Identification of Requirements |  Intuitive
Timeing of Analysis |  Iterative
Response to Changes |  Iterative
External Standards |  ISO
Internal Standards |  Without
External Software Usage |  Implicit
Security Assessment |  CA; Pen; R
Incident Handling |  Hot; CP; AU
Challenges |  Exp
Handling of Challenges |  Good; Awareness

##  Appendix R Interview 18

Category |  Interview 18 Information
---|---
Role of the person |  Architect
Size of the Company |  500 - 1000
Size of Development Team |  8 - 10
Duration of Software Development |  26 - 30
Target Market |  Infrastructure
Type of Software |  Web
Development Methode |  Agile
Importance of Security |  Subordinate
Evolution of Importance |  Increasing
Identification of Requirements |  Intuitive
Timeing of Analysis |  Iterative
Response to Changes |  Iterative
External Standards |  ISO
Internal Standards |  Without
External Software Usage |  Implicit
Security Assessment |  CA; CVE; Pen; SBOM
Incident Handling |  Hot; CP
Challenges |  Exp; Aw; Per
Handling of Challenges |  Development

##  Appendix S Interview 19

Category |  Interview 19 Information
---|---
Role of the person |  Lead
Size of the Company |  500 - 1000
Size of Development Team |  8 - 10
Duration of Software Development |  26 - 30
Target Market |  Infrastructure
Type of Software |  Web
Development Methode |  Agile
Importance of Security |  Equivalent
Evolution of Importance |  Increasing
Identification of Requirements |  Dedicated
Timeing of Analysis |  Analysis
Response to Changes |  Iterative
External Standards |  ISO
Internal Standards |  Without
External Software Usage |  Implicit
Security Assessment |  CA; CVE; Pen; R
Incident Handling |  CI; Hot; FP
Challenges |  RD; CL; Attacks
Handling of Challenges |  Development

##  Appendix T Interview 20

Category |  Interview 20 Information
---|---
Role of the person |  Architect
Size of the Company |  1001 - 5000
Size of Development Team |  -
Duration of Software Development |  26 - 30
Target Market |  Finance
Type of Software |  Web
Development Methode |  Agile ; V-Model
Importance of Security |  Highest
Evolution of Importance |  Constant
Identification of Requirements |  Implicit
Timeing of Analysis |  Analysis
Response to Changes |  Analysis
External Standards |  BSI
Internal Standards |  -
External Software Usage |  Implicit
Security Assessment |  CA; CVE; Pen; TM; EA
Incident Handling |  -
Challenges |  Aw
Handling of Challenges |  -