Unfortunately, security is rarely considered a part of the functionality of the software, and therefore almost never makes it (easily) onto the objectives list for a project. Almost every project I have been involved in, I have had to fight to get the security issue on the table.

IMO the issue of security has been left out of the training of most IT and business people from the college level through to the license and professional training courses. Many of the projects I have worked on have been driven by business units needs and wants. They were almost always unwilling to talk about security.

A serious issue in workplace management and recognition has to do with the weighting of "visible" code vs "non-visible" or "negative user experience" code. Many times programmers (in places I have worked) are recognized for the end-user fucntionality they create that contributes to productivity on a daily basis. Most security development detracts from the volume of the "visible" kicked out, and/or adds to the "negative user exeprience". The promotions I have seen handed out have not been to individuals who care about security, but rather care almost exclusively about the high "visible" code. Is it fiscally worth it to the average developer (who is normally on to the next position before 3 years are up) to spend extra time building in transparent or potentially user-impeding code for security, or to pump more "high visible" productivity warez that get them the faster promotions and the better pay, position and relations?

Security runs into the same issues as administration. You are not visible and normally not given much of a budget until the fire burns bright. Then, it may be your job.

The hard part I have seen has been the selling of business people and developers on the concepts of building a sound piece of software that can handle things not expected, providing a better path for growth, security and reusability. Maybe the issue has more to do with our consumption market mentality. We tend to burn right through resources (time/energy/money/etc) without really thinking about the long term affects of what we do. We want it now, and keep applying tape in flight.