“I Don’t Know Too Much About It”: On the Security Mindsets of Computer Science Students

Abstract

The security attitudes and approaches of software developers have a large impact on the software they produce, yet we know very little about how and when these views are constructed. This paper investigates the security and privacy (S&P) perceptions, experiences, and practices of current Computer Science students at the graduate and undergraduate level using semi-structured interviews. We find that the attitudes of students already match many of those that have been observed in professional level developers. Students have a range of hacker and attack mindsets, lack of experience with security APIs, a mixed view of who is in charge of S&P in the software life cycle, and a tendency to trust other peoples' code as a convenient approach to rapidly build software. We discuss the impact of our results on both curriculum development and support for professional developers.

Developers Are Neither Enemies Nor Users: They Are Collaborators

“…Braz et al reports the developers with experience and knowledge detected vulnerabilities better [63], a result echoed in case of empirical observation of IDE based interventions reported in [3]. Security is not easy [1] and this cannot be remedied by just attempting to educate developers on how to do it right [82]. Instead they need to be able to understand the design choices underlying an API, rather than just be shown the right way of using it.…”

Embedding Privacy Into Design Through Software Developers: Challenges and Solutions

“…Published by the IEEE Computer Society contexts, expertise, and individual concerns and characteristics that can impact their programming and priorities [4], [5], [6].…”

“…We interviewed 12 privacy champions (i.e., people who strongly care about advocating pri-vacy) to understand their motivations, strategies, and challenges when promoting privacy in software teams and organizations [4]. We also interviewed 20 computer science students to determine whether they would consider privacy features when designing an app [6]. While small in the number of interviewees, these studies gave us a thorough understanding of our participants' thought processes, decision-making, and practices.…”

“…While security might be viewed as a nonfunctional requirement and left aside, privacy might be treated even worse [6], [7]. Security can work as an enabler for privacy; conversely, it may also work as a deterrent.…”

“…Another hurdle that makes it difficult for developers to consider privacy features is their educational background. While some developers have a computer science-related degree, their education may not emphasize privacy features or ethical and responsible design [6].…”