Like, dislike, or just do it? How developers approach software development tasks

Towards Security-Focused Developer Personas

“…This is the most frequently discussed characteristic across nine articles, and appears to influence developer decision-making [33,39], developer ability to find bugs [70], and more broadly poses a challenge for developer security practices [27,34,37,40,71]. Lack of domain knowledge may also make coding tasks less desirable [72] and impact software security.…”

“…Communicating about security improves a software developer's knowledge of security and makes them feel more secure as professionals [39], while conversely, a lack of communication can degrade a developer's ability to identify vulnerabilities [40,70]. Additionally, effective communication impacts decision-making with respect to software security [36,40], while poor communication with team members may make software tasks, potentially including software security, less desirable [72] and less productive [75]. I20: Communication skills, which include several characteristics that describe a developer's ability to effectively convey their thoughts or other information, is discussed in seven articles, and appears to influence individual work quality where developers may struggle to efficiently express their thoughts and opinions on whether the code is correct or secure [32,73,78].…”

“…I22: Security input from management appears as an influence in four articles, and impacts the types of security practices that developers follow in cases when management may shift a project's security focus [76] or add additional assurance options [82]. More broadly, management can pose a challenge for developers who want to follow security practices [40] and make software security undesirable [72,82] or conversely, may push developers to consider security when they otherwise would not have [40].…”