Can you hear the ROAR of software security? How Responsibility, Optimism And Risk shape developers’ security perceptions

Abstract

We apply a social and cognitive psychological approach to better understand software developers’ perceptions of secure software development. Drawing upon psychological theories of social identity and cognitive processing, we illustrate how software developers’ self-defined social identities affect their approaches to development. We also point to behaviours that might indicate areas of increased risk of project delays or failure. Professional freelance software developers together with current computer science students addressed considerations of risk and security during development. A thematic analysis extracted three core themes of responsibility, risk, and optimism. We show how language used about responsibility for code security is framed through concepts of diffusion, displacement, and acceptance of responsibility. We also examine the way developers orientate to risk awareness, appetites for risk, and risk mitigation strategies. Examples of unrealistic optimism biases are highlighted and discussed. We discuss our findings in relation to psychological theories of responsibility, decision making and heuristics and biases, alongside prior work within software engineering. We conclude with a discussion of the advantages of using a psychological lens to examine the rationalisations and trade-offs made by developers when working with security in software.

Recognizing the known unknowns; the interaction between reflective thinking and optimism for uncertainty among software developer’s security perceptions.

“…For cybersecurity, users have been found to underestimate their risk online, increasing their vulnerability cybersecurity attacks (West, 2008;Wiederhold, 2014). In a thematic analysis of the same data presented in this article, engineers reported negative events as being damaging to their identity as an engineer (Ivory et al, 2023), indicating that for some, they associate the potential of software vulnerabilities in one's code as being a negative event. As such, a logical assumption would be that software developers are also susceptible to optimistic outlooks toward their work, and underestimating the likelihood of negative events, such as vulnerabilities in their code (as a potential marker of low-quality work).…”

“…This article is part of a larger project (Ivory, 2022) that examines both cognitive links and risk perception, alongside social identity, and responsibility within software development. The project comprises two independent, self-contained components, with the complementary package focusing on a thematic analysis of responsibility and risk acceptance (Ivory et al, 2023). The overall project information and data can be found at https://doi.org/10 .17605/OSF.IO/P6DY5.…”

“…From this the percentage of both parties identifying a word belonging to a topic or not provided the interrater reliability. We report the raw percentage agreements in Table 3 as it provides a coarse-grade assessment of potential bias, and we provide the data and the analysis code in the online repository at https://doi.org/10.17605/ OSF.IO/SJ8BT (Ivory et al, 2022), providing full transparency of data reliability.…”

Software Vulnerabilities as Cognitive Blindspots; assessing the suitability of a dual processing theory of decision making for secure coding

“…Companies that can do so should employ or delegate security testing to specific teams or individuals whose primary role is security-focused. Typically, developers are seen to prioritise functionality over security when tasked with both [6], and an absence of clearly defined roles for security can lead to a diminished sense of responsibility for ensuring software is secure [32]. Identifying specific security roles can reduce the presence of conflicting tasks, allowing for enhanced security focus, which may increase reflective thinking around security.…”

“…A catalyst for engaging system 2 processing can be peer communication [69], as it allows for greater exploration of potential viewpoints and reduces potential biases. Aligning with different social identities, such as those shared by software users, can enhance feelings of responsibility [32], which can also result in decisions being taken that account for others [38]. By acknowledging these views, developers may look at software code differently, allowing them to identify security vulnerabilities that would otherwise be missed.…”