Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

No Silver Bullet: Towards Demonstrating Secure Software Development for Danish Small and Medium Enterprises in a Business-to-Business Model

Raha Asadi, Bodil Biering, Vincent van Dijk, Oksana Kulyk, Elda Paja

TL;DR

This study investigates how Danish SMEs demonstrate software security in business-to-business contexts, motivated by the need to satisfy customers and regulatory expectations. It uses semi-structured ethnographic interviews (N=16) with Danish SMEs and a validation workshop (N=6) to identify five security demonstration approaches: Certifications, Tests/Reports, Questionnaires, Interactive Sessions, and Social Proof. The findings discuss the costs, reliability, and accessibility of each approach, highlighting that no single method suffices and that hybrid, context-aware strategies are needed. The work contributes practical recommendations for industry, academia, and regulators, and suggests future research on combining demonstration methods, accessible certifications, automated testing tools, and structured interactive formats. Overall, the paper advances understanding of how SMEs can credibly convey security status to diverse stakeholders while balancing resource constraints and varying client demands.

Abstract

Software developing small and medium enterprises (SMEs) play a crucial role as suppliers to larger corporations and public administration. It is therefore necessary for them to be able to demonstrate that their products meet certain security criteria, both to gain trust of their customers and to comply to standards that demand such a demonstration. In this study we have investigated ways for SMEs to demonstrate their security when operating in a business-to-business model, conducting semi-structured interviews (N=16) with practitioners from different SMEs in Denmark and validating our findings in a follow-up workshop (N=6). Our findings indicate five distinctive security demonstration approaches, namely: Certifications, Reports, Questionnaires, Interactive Sessions and Social Proof. We discuss the challenges, benefits, and recommendations related to these approaches, concluding that none of them is a one-size-fits all solution and that more research into relative advantages of these approaches and their combinations is needed.

No Silver Bullet: Towards Demonstrating Secure Software Development for Danish Small and Medium Enterprises in a Business-to-Business Model

TL;DR

This study investigates how Danish SMEs demonstrate software security in business-to-business contexts, motivated by the need to satisfy customers and regulatory expectations. It uses semi-structured ethnographic interviews (N=16) with Danish SMEs and a validation workshop (N=6) to identify five security demonstration approaches: Certifications, Tests/Reports, Questionnaires, Interactive Sessions, and Social Proof. The findings discuss the costs, reliability, and accessibility of each approach, highlighting that no single method suffices and that hybrid, context-aware strategies are needed. The work contributes practical recommendations for industry, academia, and regulators, and suggests future research on combining demonstration methods, accessible certifications, automated testing tools, and structured interactive formats. Overall, the paper advances understanding of how SMEs can credibly convey security status to diverse stakeholders while balancing resource constraints and varying client demands.

Abstract

Software developing small and medium enterprises (SMEs) play a crucial role as suppliers to larger corporations and public administration. It is therefore necessary for them to be able to demonstrate that their products meet certain security criteria, both to gain trust of their customers and to comply to standards that demand such a demonstration. In this study we have investigated ways for SMEs to demonstrate their security when operating in a business-to-business model, conducting semi-structured interviews (N=16) with practitioners from different SMEs in Denmark and validating our findings in a follow-up workshop (N=6). Our findings indicate five distinctive security demonstration approaches, namely: Certifications, Reports, Questionnaires, Interactive Sessions and Social Proof. We discuss the challenges, benefits, and recommendations related to these approaches, concluding that none of them is a one-size-fits all solution and that more research into relative advantages of these approaches and their combinations is needed.

Paper Structure

This paper contains 51 sections, 3 figures, 1 table.

Table of Contents

  1. Introduction
  2. Background
  3. Specification and Implementation of Security Requirements
  4. Labeling and Certification
  5. Further Security Practices in Companies
  6. Role of Trust in Security
  7. Internal Communication
  8. Frameworks for SMEs
  9. METHODOLOGY
  10. Qualitative Interviews - Preparation
  11. Participant profiling
  12. Reach-out strategy and interviewee recruitment
  13. Interview structure planning
  14. Interview data analysis
  15. Validation Workshop
  16. ...and 36 more sections

Figures (3)

  • Figure 1: Study process overview
  • Figure 2: Five key methods for security demonstration and what they each encompass
  • Figure 3: Photograph of workshop notes