The Case for Adaptive Security Interventions
| Autor: | Mark Levine, Irum Rauf, Bashar Nuseibeh, John N. Towse, Awais Rashid, Helen Sharp, Thein Than Tun, Dirk van der Linden, Paul Lunn, Tamara Lopez, Marian Petre |
|---|---|
| Jazyk: | angličtina |
| Rok vydání: | 2021 |
| Předmět: |
Social psychology (sociology)
Knowledge management G500 business.industry Computer science G400 media_common.quotation_subject Psychological intervention G900 Usability social psychology Space (commercial competition) security decisions cognitive psychology security goals Order (exchange) Software security assurance developers adaptive software engineering business Sophistication Security interventions Software Secure coding media_common |
| Zdroj: | Rauf, I, Petre, M, Tun, T, Lopez, T, Lunn, P, van der Linden, D, Towse, J, Sharp, H, Levine, M, Rashid, A & Nuseibeh, B 2021, ' The Case for Adaptive Security Interventions ', ACM Transactions on Software Engineering and Methodology, vol. 31, no. 1, 9, pp. 1-52 . https://doi.org/10.1145/3471930 |
| ISSN: | 1557-7392 1049-331X |
| DOI: | 10.1145/3471930 |
| Popis: | Despite the availability of various methods and tools to facilitate secure coding, developers continue to write code that contains common vulnerabilities. It is important to understand why technological advances do not sufficiently facilitate developers in writing secure code. To widen our understanding of developers' behaviour, we considered the complexity of the security decision space of developers using theory from cognitive and social psychology. Our interdisciplinary study reported in this article (1) draws on the psychology literature to provide conceptual underpinnings for three categories of impediments to achieving security goals, (2) reports on an in-depth meta-analysis of existing software security literature that identified a catalogue of factors that influence developers' security decisions, and (3) characterises the landscape of existing security interventions that are available to the developer during coding and identifies gaps. Collectively, these show that different forms of impediments to achieving security goals arise from different contributing factors. Interventions will be more effective where they reflect psychological factors more sensitively and marry technical sophistication, psychological frameworks, and usability. Our analysis suggests “adaptive security interventions” as a solution that responds to the changing security needs of individual developers and a present a proof-of-concept tool to substantiate our suggestion. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|