Material Suplementar - Is secure software development education necessary in the software industry? Answers from professionals of a technology hub in Brazil

Context: The education and training of information security professionals is essential to ensure the protection of data and systems, as well as the privacy and security of sensitive information. Problem: This work aims to explore the context of a local technology hub to answer the following research question: Is secure software development education necessary in the software industry? Solution: To answer this question, an exploratory study was performed to understand the need for secure software development education from the point of view of software practitioners in a technology hub. Method: A questionnaire was prepared and sent to professionals of a Brazilian technology hub. Answers were analyzed by using qualitative research methods. Results: We obtained thirty eight answers. According to the results obtained, the majority of participants consider information security education important for the development of secure software. However, there is still a lack of information security education. Contributions: It is concluded that companies should invest more in adequate and comprehensive training on the topic, in addition to encouraging and rewarding professionals who prioritize software security in their projects. It is essential to disseminate a culture of information security throughout the organization, from senior management to development professionals, to make everyone aware of the importance of information security and their responsibility in maintaining it. Finally, it should be noted that developers have a crucial role in ensuring software security, being responsible for seeking knowledge and improving their skills in secure development through training, reading and practice. (Paper accepted in the Brazilian Symposium of Software Engineering)