This is a common issue but something that can be resolved relatively easily. First, management has to make their support of security and risk management known by spreading the message and holding people accountable. Second, get your teams in the same meetings. Have developers/QA staff attend security-related meetings and security/compliance staff attend development/QA-related meetings.
Finally, get all staff members some cross-training in the respective areas. There's no reason why security/compliance staff shouldn't know the basics of software development/quality and why developers/QA staff shouldn't know the essential concepts of information security. Pull these three things together and you'll have yourself a workable solution.
Here is some more advice for development teams battling with similar struggles:
- How to get management on board with Web 2.0 security issues
Ways to get management buy-in for Web 2.0 security testing and quality assurance and to bolster application security before deployment are given in this tip.
Handling the people side of Agile software development
Expert tester advises agile development teams to adopt cross functionality, use only proven agile practices and encourage strong tester and developer relationships.
Tips for software testers: Getting along with developers
End software project slowdowns caused by fighting between software testers and developers with these four tips.
Related Q&A from Kevin Beaver
Is the PCI DSS a sufficient guideline for implementing an application security program? Should organizations take steps beyond the mandated PCI ...continue reading
The number of endpoint security vulnerabilities is daunting, but endpoint admins should first focus on updating patches against Windows malware.continue reading
It's not enough to have a traditional Windows game plan for security. Diverse devices require endpoint management policies and management buy-in.continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.