CyberSecurity Challenges for Software Developer Awareness Training in Industrial Environments

Abstract

Awareness of cybersecurity topics facilitates software developers to produce secure code. This awareness is especially important in industrial environments for the products and services in critical infrastructures. In this work, we address how to raise awareness of software developers on the topic of secure coding. We propose the "CyberSecurity Challenges", a serious game designed to be used in an industrial environment and address software developers' needs. Our work distills the experience gained in conducting these CyberSecurity Challenges in an industrial setting. The main contributions are the design of the CyberSecurity Challenges events, the analysis of the perceived benefits, and practical advice for practitioners who wish to design or refine these games.

CyberSecurity Challenges: Serious Games for Awareness Training in Industrial Environments

“…An extended experiment, using the same artifact but in an academic setting, also shows good indicators of its suitability to train future generations of junior industrial software developers. For a more in-depth discussion on the presented results, we refer the reader to the literature by the same authors [10][11][12][13][14][15][16][17][18][19][20].…”

“…The concept of IT-security awareness is typically used in IT security management contexts. We adapt these concepts to software developers as follows [16]: perception -knowledge of existing software vulnerabilities, protection -knowing the existing mechanisms, e.g., secure coding guidelines and software development best practices, that avoid software vulnerabilities, and behaviorknowledge and intention to write secure code.…”

“…In the following sub-sections, we present a brief overview and discussion of the survey's main results, participant feedback, and an overview of the lessons learned on the design of CSC games and events. For a more in-depth overview of the empirical studies, we refer the reader to the work published by the same authors in [10][11][12][13][14][15][16][17][18][19][20].…”

“…Finally, the aspect challenges (CH) looks at the different categories of challenges (as introduced before), challenge types suitable for the industry, the different phases of a challenge, and tools to create the challenges. Detailed discussions on each of these aspects can be found in [10][11][12][13][14][15][16][17][18][19][20].…”

Is Secure Coding Education in the Industry Needed? An Investigation Through a Large Scale Survey

“…It will be the software developer as well that will have to correct the vulnerabilities in code. This study is embedded in our investigation on the usage of serious games as a means to raise secure coding awareness of software developers in the industry [13]- [21]. Our primary motivation to conduct the present work is to motivate awareness training by answering the question "is secure coding education in the industry needed?".…”