The Human Dimension of Software Security and Factors Affecting Security Processes

Abstract

Usable security for software developers is a research direction that is in its early stages. Even though developers typically have technical expertise, they are not necessarily security experts and need support when dealing with security. This thesis focuses on the human aspect of software security within the overall development process. The research employes mixed methods, including Cognitive Walkthrough studies, interviews, and an online survey study. We started by studying usability issues in code analysis tools, and designed a visual analysis environment to support collaboration between team members and exploration during security analysis of source code. However, while working on this project, we recognized that the software security problem is a larger one, relating to the overall process of integrating security in the Software Development Lifecycle. Thus, through 13 interviews and an online survey with 123 software developers, we explored real-life software security practices, how developers acquire security knowledge, and the motivators and deterrents to software security. Based on our empirical studies, we identified recommendations that can help support developers handle security throughout the Software Development Lifecycle. Our qualitative and quantitative analyses showed varying approaches to software security, and clear discrepancies between existing and best practices. Through exploring developers' motivations towards software security, we identified both extrinsic and intrinsic motivations. We found that acting towards software security volitionally and for reasons extending beyond mandates can lead to better security processes and better developer-engagement in these processes. Particularly, our studies showed that when the different entities involved in the Software Development Lifecycle communicate and collaborate, and when security is perceived as a common and shared responsibility, this can positively influence software security, e.g., by promoting internal motivations which are associated with improved engagement and cognitive abilities. Towards promoting the internalization of software security, we proposed a human-oriented model to describe how external software security motivations can be internalized. Our model highlights the interplay between security knowledge, team collaboration, and internal motivations to security. Working on this thesis was a wonderful journey with its fair share of ups and downs. I would like to express my gratitude to all those who have supported me throughout this journey. To my thesis supervisor, Sonia Chiasson, for her continuous support and guidance, and for her insights that helped elevate the quality of this research. Thank you Sonia for always being there, especially in the many sleepless nights before deadlines, and for being a friend, besides being a thesis supervisor. Thanks to the members of my committee, Heather Lipford, Timothy Lethbridge, Alejandro Ramirez, and Robert Biddle whose expertise, guidance, and feedback helped shape this thesis. I would e...

An investigation into software quality and security: Past research works and existing gaps

“…The outcome is the reduction in the risk of overlooking critical security requirements or introducing security flaws throughout the implementation process. To build and deploy a secure software system, there is need for the integration of security features into the life cycle of application development and align current SSE methods [186], [187]. However, most organizations view security as a post-development process, and hence security is not considered during the pre-development phase.…”

Security risks in the software development lifecycle: A review

“…On the other hand, a strong correlation has been found in [34] between the financial records of the software development enterprises (such as sales and financial performance) and the number of vulnerabilities that their products may contain. As discussed in [35], organizations' security efforts are less effective when developers perceive a disinterest in adopting software security practices. This usually occurs when there are no perceived negative consequences to the customers or the business from the lack of security in the SDLC.…”

“…Several studies have pointed out the need to investigate the behavioral aspects of security adoption. In particular, developers' motivations and attitudes towards security [49], [50], [58], [35] is a hot topic. However, despite the availability of these many resources, developers continue to introduce security vulnerabilities in source code, and organizations lack proper guidelines for designing strategies to mitigate poor security.…”

“…[50], [58], [35] Pointed out the need to investigate the behavioral aspects of security adoption, in particular, developers' motivations and attitudes towards security. [59] Found that despite receiving a tailored security checklist as a reminder during code reviews, developers are unable to find more vulnerabilities than when are just instructed to focus on security issues.…”

Supporting Human-Centered Design in Psychologically Distant Problem Domains: The Design for Cybersecurity Cards

“…However, cybersecurity is often not seen as an 'essential design principle' (Schwartz et al, 2018), and research suggests that cybersecurity awareness across the design process is inconsistent (Kim et al, 2018). Efforts to incorporate cybersecurity in the design process have focused on software (Assal, 2018;Lukowiak et al, 2014), but less attention has been paid to early-stage conceptual design, and specifically, human-centered design (HCD). HCD, often described with phases of Research, Analyze, Ideate, Build, and Communicate (Roschuni et al, 2011), intends to help designers tackle complex problems, including cybersecurity.…”