An Empirical Study on Security Knowledge Sharing and Learning in Open Source Software Communities

Abstract

Open source software (OSS) security has been the focus of the security community and practitioners over the past decades. However, the number of new vulnerabilities keeps increasing in today’s OSS systems. With today’s increasingly important and complex OSS, lacking software security knowledge to handle security vulnerabilities in OSS development will result in more breaches that are serious in the future. Learning software security is a difficult and challenging task since the domain is quite context specific and the real project situation is necessary to apply the security concepts within the specific system. Many OSS proponents believe that the OSS community offers significant learning opportunities from its best practices. However, studies that specifically explore security knowledge sharing and learning in OSS communities are scarce. This research is intended to fill this gap by empirically investigating factors that affect knowledge sharing and learning about software security and the relationship among them. A conceptual model is proposed that helps to conceptualize the linkage between socio-technical practices and software security learning processes in OSS communities. A questionnaire and statistical analytical techniques were employed to test hypothesized relationships in the model to gain a better understanding of this research topic.

Considerations Regarding the Inclusion of Cybersecurity in Knowledge Management

“…Knowledge management has also a social and psychological component, highlighted by the culture of the organizations. In the context of information security, security culture decides how much security knowledge is disseminated within the community and what knowledge learners can learn [7]. Like information flows, knowledge sharing, and knowledge transfer operations must also enforce access control and security policies [8].…”

Towards Social Capital in a Network Organization: A Conceptual Model and an Empirical Approach

“…Over the last two decades, OSS development has gained popularity, and we have witnessed successful OSS projects such as Linux, MySQL, and Hadoop. However, the majority of OSS projects have failed due to different reasons, e.g., [ 35 , 36 ]. In this paper, we try to understand the impact of SC on OSS development and whether it has a relation with the success of OSS projects.…”