Influences of developers' perspectives on their engagement with security in code

Rauf, Irum and Lopez, Tamara and Sharp, Helen and Petre, Marian and Tun, Thein T. and Levine, Mark and Towse, John and van der Linden, Dirk and Rashid, Awais and Nuseibeh, Bashar (2022) Influences of developers' perspectives on their engagement with security in code. In: CHASE '22. Proceedings - 15th International Conference on Cooperative and Human Aspects of Software Engineering, CHASE 2022 . Association for Computing Machinery, Inc, New York, pp. 86-95. ISBN 9781450393423

[img]
Text (Influences of developers' perspectives on their engagement with security in code[20])
Influences_of_developers_perspectives_on_their_engagement_with_security_in_code_20_.pdf - Accepted Version
Available under License Creative Commons Attribution.

Download (1MB)

Abstract

Background: Recent studies show that secure coding is about not only technical requirements but also developers’ behaviour. Objective: To understand the influence of socio-technical contexts on how developers attend to and engage with security in code, software engineering researchers collaborated with social psychologists on a psychologically-informed study. Method: In a preregistered, between-group, controlled experiment, 124 developers from multiple freelance communities, were primed toward one of three identities, following which they completed code review tasks with open-ended responses. Qualitative analysis of the rich data focused on the attitudes and reasoning that shaped their identification of security issues within code. Results: Overall, attention to code security was intermittent and heterogeneous in focus. Although social identity priming did not significantly change the code review, qualitative analysis revealed that developers varied in how they noticed issues in code, how they addressed them, and how they justified their choices. Conclusion: We found that many developers do think about security – but differently from one another. Hence, effective interventions to promote secure coding must be appropriate to the individual development context. Data is uploaded at: https://osf.io/3jvrk/files/

Item Type:
Contribution in Book/Report/Proceedings
Additional Information:
© ACM, 2022. This is the author's version of the work. It is posted here by permission of ACM for your personal use. Not for redistribution. The definitive version was published in CHASE 2022 http://doi.acm.org/10.1145/3528579.3529180
Uncontrolled Keywords:
Data Sharing Template/yes
Subjects:
ID Code:
168788
Deposited By:
Deposited On:
01 Nov 2022 16:00
Refereed?:
Yes
Published?:
Published
Last Modified:
24 Nov 2022 00:15