How Does Usable Security (Not) End Up in Software Products? Results From a Qualitative Interview Study

Abstract

For software to be secure in practice, users need to be willing and able to appropriately use security features. These features are usually implemented by software professionals during the software development process (SDP), who may be unable to consider the usability of these mechanisms.While research has made progress in supporting developers in creating secure software products, very little attention has been paid to whether and how these security features are made usable. In a semi-structured interview study with 25 software professionals (software developers, designers, architects), we explored how they and other decision-makers encounter and deal with security and usability during the software development process in their companies.Based on 37 hours of interview recordings, we qualitatively analyzed and investigated 23 distinct development contexts in detail. In addition to individual awareness and factors that directly influence the implementation phase, we identify a high impact of contextual factors, such as stakeholder pressure, presence of expertise, and collaboration culture, and the specific implementation of the SDP on usable security in software products. We conclude our work by highlighting important gaps, such as studying and improving contextual factors that contribute to usable security and discussing potential improvements of the status quo.

"We are a startup to the core": A qualitative interview study on the security and privacy development practices in Turkish software startups

“…We saw that more mature startups did consider security and privacy, and had dedicated teams or persons for them, or outsourced them to third parties. We find that, except for considering both KVKK and GDPR, Turkish startup developers' security and privacy perceptions and processes resemble those found in published literature based on interviews with developers from various company sizes in Germany, the United States of America, the United Kingdom, Brazil, Israel, and China [22], [23], [46], [50], [59], [62].…”

Usable Security: A Systematic Literature Review

“…Those involved in software design and development greatly influence the implementation of security and, consequently, whether security is implemented in a usable way. In this regard, Gutfleish et al [64], in a series of 25 interviews conducted in different development contexts, investigated how usable security is handled within the software development process: a process that involves several stages (e.g., requirements definition, code writing, and debugging) and different stakeholders (managers, designers, developers, and customers). The results of that qualitative study showed that the topic of usable security had received little attention within the developer community.…”

Investigating Practices and Opportunities for Cross-functional Collaboration around AI Fairness in Industry Practice

“…However, it is important to acknowledge that privacy and security are still often de-prioritized by individual developers and organizations [7,37,53]. In particular, prior research indicated that the deprioritization of privacy is especially pronounced in smaller organizations or teams [37]. Indeed, participants in our study who mentioned piggybacking on privacy procedure were all from largesize technology companies (with 25,000+ employees) that may already have more established privacy processes than smaller organizations in place.…”

“…However, it is important to acknowledge that privacy and security are still often de-prioritized by individual developers and organizations [7,37,53]. In particular, prior research indicated that the deprioritization of privacy is especially pronounced in smaller organizations or teams [37].…”