Software Vulnerabilities

This experiment is about software vulnerabilities and code review. In the following, we will ask you some questions about this topic before concluding the experiment.

Let us kindly remind you that your answers are anonymized and cannot be traced back to you.

Please choose an option for the following statements:

No Yes
I am familiar with the concept of software vulnerabilities
I have experience with security incidents
I have participated in security courses and/or training
I use what I have learned in practice

Specify your agreement with the following statements:

Never Rarely Occasionally A moderate amount A great deal I don't know Not Applicable
I keep myself up to date with security information
It is part of my job responsibility to look for vulnerabilities
I actively consider vulnerabilities when designing software
I actively consider vulnerabilities when coding
I actively look for vulnerabilities when reviewing

Please answer the following questions regarding checklists:

Strongly Disagree Disagree Neutral Agree Strongly Agree I don't know Not Applicable
I prefer using checklists for code reviewing
Checklists are mainly for inexperienced code reviewers
Checklists improve my code review efficiency
Checklists help in finding security issues
Never Rarely Occasionally A moderate amount A great deal I don't know Not Applicable
I have used checklists for code review before

Considering the project you work on the most, please rate your agreement with the following statements. 

Strongly Disagree Disagree Neutral Agree Strongly Agree I don't know Not Applicable
Software developers are aware of potential security issues
Software developers have expertise in software security
Detection tools are used to find software vulnerabilities
Checklists are used to find software vulnerabilites
Code review is used to find software vulnerabilities
Third-party libraries are checked for security issues
Security documentation and training are available
Enough time is available to consider security aspects

Considering the project you work on the most, rate how effective, in your opinion, the following measures would be in reducing the number of vulnerabilities:

Not at all effective Slightly effective Somewhat effective Very effective Extremely effective I don't know Not Applicable
Increasing awareness of potential security issues
Increasing the use of code review to find software vulnerabilities
Writing more and better tests
Having access to security vulnerability checklists
Having more and better security documentation and training
Reinforcing the security check of third-party libraries
Having people responsible for security in the project/company
Increasing the use of tools to identify security bugs
Learning from past vulnerabilities that affected the project
Having more time to consider security aspects

Would there be any other useful solutions to reduce the number of vulnerabilities in the project you work on the most?