Interventions for Software Security: Creating a Lightweight Program of Assurance Techniques for Developers

Abstract

Summary Though some software development teams are highly effective at delivering security, others either do not care or do not have access to security experts to teach them how. Unfortunately, these latter teams are still responsible for the security of the systems they build: systems that are ever more important to ever more people. We propose that a series of lightweight interventions, six hours of facilitated workshops delivered over three months, can improve a team's motivation to consider security and awareness of assurance techniques, changing its security culture even when no security experts are involved. The interventions were developed after an Appreciative Inquiry and Grounded Theory survey of security professionals to find out what approaches work best. We tested the interventions in a participatory action research field study where we delivered the workshops to three software development organizations and evaluated their effectiveness through interviews beforehand, immediately afterwards, and after twelve months. We found that the interventions can be effective with teams with limited or no security experience and that improvement is long‐lasting. This approach and the learning points arising from the work here have the potential to be applied in many development teams, improving the security of software worldwide.

Privacy Champions in Software Teams: Understanding Their Motivations, Strategies, and Challenges

“…Such behaviours and attitudes are valuable in organisations that prioritise security [35]. Peer developers view Security Champions as essential players in software security [70,77,78]. They can be an experienced hacker who helps testers in fnding vulnerabilities [74], an intermediary between the security and development teams [25,70], or the leader in threat modelling activities [10,63].…”

Developers Are Neither Enemies Nor Users: They Are Collaborators

“…• Network Effect -Choosing solutions based on the number of their users. Group behavior is also observed in case of assurance mechanisms [30]- [32], [43], [54]…”

“…• Organizational Goals -Software development methods rush for functionality. Developers need regular motivation and organization push [2]- [4], [28], [30], [33], [36], [40], [55]- [58] Take-away. The API providers are ideally placed to collaborate with developers and link the security benefits and pitfalls of how their APIs are used.…”

“…Conflicting goals signifies concentration of security knowledge within experts (power play) [29], [30], [33] leading to shifting responsibility and incentives. Derr et al and Vaniea et al find that security is not a priority when picking a library by app developers [28], [51].…”

Interventions for long‐term software security: Creating a lightweight program of assurance techniques for developers

“…This paper presents research into these questions: a survey of security professionals who work with software developers to address the first question and, based on the results, the subsequent creation and trials of a package, “Developer Security Essentials,” to address the second. It expands on an earlier paper by the authors, incorporating new longitudinal data from interviews one year after the intervention (Section 6.7), a comparison of the activities of different teams (Section 5.3), a more extensive literature survey (Section 2), and a discussion of “Blockers and Motivators” encountered by the different teams (Section 6.7).…”