"Hopefully We Are Mostly Secure": Views on Secure Code in Professional Practice

Abstract

Security of software systems is of general concern, yet breaches caused by common vulnerabilities still occur. Software developers are routinely called upon to "do more" to address this situation. However there has been little focus on the developers' point of view, and understanding how security features in their day-to-day activities. This paper reports preliminary findings of semi-structured interviews taken during an ethnographic study of professional software developers in one organization who are not security experts. The overall study aims to understand how security features in day-to-day practice, while analysis of the interview data asks whether developers are responsible for security. The study reveals that awareness around security matters is raised through several paths including processes, standards, practices and company training and that a focus on security is driven by contextual factors. Security is taken care of with policies and through safeguards, and is handled differently depending on whether a team is developing new features, and hence "looking forward", or working with existing code and hence "looking back". Developers take and share responsibility for security in the code, but suggest that their responsibility has limits, and relies on collective practice.

Taking the Middle Path: Learning About Security Through Online Social Interaction

“…Our interviews taken with engineers in office environments suggest that developers who are not in specialist cyber security teams often understand, in principle, how to counter common vulnerabilities, and have an awareness of the need to protect information for companies and for users of software [9]. But at the same time, and in agreement with other findings [11], these developers report that security is not at the forefront of their daily activity or decision making.…”

“…The interactions and conversations we have observed within office settings [9] and comment streams on Stack Overflow [7], [8] suggest that secure coding practice is supported in both kinds of environment through personal networks of practice [14] that operate within larger environments. Online, in websites like Stack Overflow, such networks operate within the comment streams attached to question and answer posts.…”

“…Upvotes are not enough. Developers in the field [9] indicate that while community voting activity in online sources is helpful for isolating promising information, subsequent problem-solving of security problems often requires additional support in the form of personal connections made between individuals.…”

“…Our larger research program is investigating ways to initiate and sustain secure software development practice. In a series of studies, we have shown how developers talk about security in Stack Overflow posts given the "security" tag [7] [8], and examined how security figures into practice within office settings [9]. The approach taken in these studies does not assess the quality of the information about security developers provide to one another, but rather seeks to understand more about how they engage with and guide one another in practice.…”

OASIS: Weakening User Obligations for Security-critical Systems

“…Applicability. We intend to conduct a more comprehensive empirical study in order to evaluate relevance of the suggested revisions, and compare their acceptability by so ware developers, who may not always follow security practices [38]. In particular, OASIS assumes that the requirements can be expressed in LTL, which might not always be the case, especially for cases relating to complex data structures.…”