Towards Security-Focused Developer Personas

Abstract

Usability issues are one of the reasons behind the lack of security testing tool adoption by software developers. The design of security testing tools by Security Software Creators (SSCs) can be strengthened through the use of security focused developer personas which allow an improved understanding of software developer behaviour. Despite the widespread use of personas in other fields, limited research exists that specifically tailors personas to software developers from a security perspective. This research uses an interview study with 20 participants to explore 18 security focused developer persona dimensions, as well as a survey study with 40 participants to identify a range of dimension-specific information.Based on the results from the two studies, we developed a security focused developer persona framework that provides SSCs with a structured approach to create securityfocused developer personas.I would also like to thank my thesis defence committee members -Dr. Elizabeth Stobert, and Dr. Alejandro Ramirez. Their insights and constructive critique have greatly enriched my work and contributed to its successful completion. Additionally, I would like to thank Dr. Alan Tsang for chairing the defence.Furthermore, I would like to acknowledge the academic community and Carleton University for providing the necessary resources and opportunities to pursue this research.Without their commitment to education and research, this thesis would not have been possible. Thank you all for your contributions, and I am truly grateful for the impact you have had on my academic and personal growth.