  Software security requirements have been traditionally considered as a
non-functional attribute of the software. However, as more software started to
provide services online, existing mechanisms of using firewalls and other
hardware to secure software have lost their applicability. At the same time,
under the current world circumstances, the increase of cyber-attacks on
software is ever increasing. As a result, it is important to consider the
security requirements of software during its design. To design security in the
software, it is important to obtain the views of the developers and managers of
the software. Also, it is important to evaluate if their viewpoints match or
differ regarding the security. Conducting this communication through a specific
model will enable the developers and managers to eliminate any doubts on
security design and adopt an effective strategy to build security into the
software. In this paper, we analyzed the viewpoints of developers and managers
regarding their views on security design. We interviewed a team of 7 developers
and 2 managers, who worked in two teams to build a real-life software product
that was recently compromised by a cyber-attack. We obtained their views on the
reasons for the successful attack by the malware and took their recommendations
on the important aspects to consider regarding security. Based on their
feedback, we coded their open-ended responses into 4 codes, which we
recommended using for other real-life software as well.
