Challenging Software Developers:Dialectic as a Foundation for Security Assurance Techniques

Weir, Charles and Noble, James and Rashid, Awaid (2020) Challenging Software Developers:Dialectic as a Foundation for Security Assurance Techniques. Journal of Cybersecurity. ISSN 2057-2093

[img]
Text (Challenging Software Developers)
Weir_ChallengingSoftwareDevelopers.pdf - Accepted Version
Available under License Creative Commons Attribution-NonCommercial.

Download (740kB)

Abstract

Development teams are increasingly expected to deliver secure code, but how can they best achieve this? Traditional security practice, which emphasises 'telling developers what to do' using checklists, processes and errors to avoid, has proved difficult to introduce. From analysis of industry interviews with a dozen experts in app development security, we find that secure development requires dialectic: a challenging dialog between the developers and a range of counterparties, continued throughout the development cycle. Analysing a further survey of sixteen industry developer security advocates, we identify the six assurance techniques that are most effective at achieving this dialectic in existing development teams, and conclude that the introduction of these techniques is best driven by the developers themselves. Concentrating on these six assurance techniques, and the dialectical interactions they involve, has the potential to increase the security of development activities and thus improve software security for everyone.

Item Type:
Journal Article
Journal or Publication Title:
Journal of Cybersecurity
Uncontrolled Keywords:
/dk/atira/pure/subjectarea/asjc/1700/1712
Subjects:
ID Code:
143417
Deposited By:
Deposited On:
21 Apr 2020 09:40
Refereed?:
Yes
Published?:
Published
Last Modified:
27 Nov 2020 08:06