Interventions for Software Security:Creating a Lightweight Program of Assurance Techniques for Developers

Weir, Charles and Blair, Lynne and Becker, Ingolf and Noble, James and Sasse, Angela and Rashid, Awais (2019) Interventions for Software Security:Creating a Lightweight Program of Assurance Techniques for Developers. In: Proceedings - 2019 IEEE/ACM 41st International Conference on Software Engineering. IEEE, pp. 41-50. ISBN 9781728117614

[img]
Preview
PDF (Interventions for Software Security)
WeirSEIP2019CameraReady.pdf - Accepted Version
Available under License Creative Commons Attribution-NonCommercial.

Download (735kB)

Abstract

Though some software development teams are highly effective at delivering security, others either do not care or do not have access to security experts to teach them how. Unfortunately, these latter teams are still responsible for the security of the systems they build: systems that are ever more important to ever more people. We propose that a series of lightweight interventions, six hours of facilitated workshops delivered over three months, can improve a team’s motivation to consider security and awareness of assurance techniques, changing its security culture even when no security experts are involved. The interventions were developed after an Appreciative Inquiry and Grounded Theory survey of security professionals to find out what approaches work best. They were then validated in fieldwork with a Participatory Action Research study that de-livered the workshops to three development organizations. This approach has the potential to be applied by many development teams, improving the security of software worldwide.

Item Type:
Contribution in Book/Report/Proceedings
Uncontrolled Keywords:
/dk/atira/pure/subjectarea/asjc/1700/1712
Subjects:
ID Code:
131282
Deposited By:
Deposited On:
15 Feb 2019 14:00
Refereed?:
Yes
Published?:
Published
Last Modified:
27 Sep 2020 06:47