Social influences on secure development tool adoption

Abstract

Security tools can help developers build more secure software systems by helping developers detect or fix security vulnerabilities in source code. However, developers do not always use these tools. In this paper, we investigate a number of social factors that impact developers' adoption decisions, based on a multidisciplinary field of research called diffusion of innovations. We conducted 42 one-on-one interviews with professional software developers, and our results suggest a number of ways in which security tool adoption depends on developers' social environments and on the channels through which information about tools is communicated. For example, some participants trusted developers with strong reputations on the Internet as much as they trust their colleagues for information about security tools.

Technical and Personal Factors Influencing Developers' Adoption of Security Tools

“…For a more detailed discussion of our methodology, please see our previous paper drawing on this study [11].…”

“…In a previous paper [11], we used the same 42 interviews described in the present paper to examine social factors influencing security tool adoption. We direct the reader to that paper for our description of Social System and Communication Channel factors.…”

How practitioners perceive the relevance of software engineering research

“…to allow practitioners to provide feedback based on their personal experience. We decided not to ask about the willingness to adopt because other research has shown that adoption depends on many different factors (social, cultural, and educational factors, exposure, and many more [7] [8]), which are often external to the actual research. A reliable assessment of the adoptability would require a significant time commitment by practitioners.…”

“…Asking about adoption assumes the availability of tools, which is not always the case, e.g., for empirical papers. In addition, adoption typically depends on different factors, e.g., social, culture, education, exposure, and many more [7] [8], which often are external to the actual research. These issues make it difficult for developers to provide objective assessments of the adoptability.…”

Evaluating code complexity triggers, use of complexity measures and the influence of code complexity on maintenance time

“…It would be particularly interesting to determine those measures used in open source product development because there the use of measurement tools is fundamentally regulated in a different way. While tool choice is often affected by corporate regulations and standards (Xiao et al 2014), open source developers are more likely to have greater freedom in their choice of tools.…”