Interventions for long‐term software security: Creating a lightweight program of assurance techniques for developers

Abstract

Though some software development teams are highly effective at delivering security, others either do not care or do not have access to security experts to teach them how. Unfortunately, these latter teams are still responsible for the security of the systems they build: systems that are ever more important to ever more people. We propose that a series of lightweight interventions, six hours of facilitated workshops delivered over three months, can improve a team's motivation to consider security and awareness of assurance techniques, changing its security culture even when no security experts are involved. The interventions were developed after an Appreciative Inquiry and Grounded Theory survey of security professionals to find out what approaches work best. We tested the interventions in a participatory action research field study where we delivered the workshops to three software development organizations and evaluated their effectiveness through interviews beforehand, immediately afterwards, and after twelve months. We found that the interventions can be effective with teams with limited or no security experience and that improvement is long-lasting. This approach and the learning points arising from the work here have the potential to be applied in many development teams, improving the security of software worldwide.

Security Notifications in Static Analysis Tools: Developers’ Attitudes, Comprehension, and Ability to Act on Them

“…Its advantage over SATs is primarily that it can operate on code where the full source is not available, such as with apps with third-party libraries that download and run code during execution. Both static and dynamic analysis provide useful insights for testing, but neither are comprehensive [102]. While we focus on SATs in this paper, our findings would likely apply to dynamic analysis notification content as well.…”

“…SATs can work without needing to run the code itself so they can be integrated into IDEs or even work off of websites which makes it easier for developers to find and fix defects earlier in the development process rather than waiting till the test and production stages. SATs are recommended as the first line of defence against vulnerabilities [102], and developers have previously acknowledged their usefulness in finding security vulnerabilities [97]. Various academic researchers recommend developers use SATs [45,58,86,101,102], and they are also used by large technology companies such as Microsoft [22,91], Facebook [31], and Google [5,7,82,83], as well as in open-source projects such as Linux, Firefox, and Qt [14,48,99,105].…”

A Passion for Security: Intervening to Help Software Developers

“…• Motivate developers to drive their own security improvements [36]; • Encourage developers to adopt a subset of key assurance techniques, specifically Threat Assessment, Configuration Review, Automated Static Analysis, Source Code Review, and Penetration Testing [36];…”

“…• Incentivization Session, and • Threat Assessment Based on early trials of a workshop-based intervention [36] we concluded two further requirements:…”

“…This research project addresses the objective of defining a cost-effective intervention to support software development teams in creating secure products and services. In earlier work the authors identified requirements and an approach using workshops to sensitize developers to the importance of security [36]. Based on this they derived a set of requirements for this package (Section III) and concluded the need for objective assessment of its impact.…”