Interventions for long‐term software security: Creating a lightweight program of assurance techniques for developers. (12th November 2019)

• Record Type: Journal Article
• Authors: Weir, Charles; Becker, Ingolf; Noble, James; Blair, Lynne; Sasse, M. Angela; Rashid, Awais
• Other Names: Bishop Judith guestEditor.; Cooper Kendra M.L. guestEditor.; Sharp Helen guestEditor.; Whalen Michael guestEditor.
• Is Part Of: Software, practice & experience. Volume 50:Number 3(2020)
• Page Start: 275
• Page End: 298
• Publication Date: 2019-11-12
• Subjects: action research -- cybersecurity -- developer‐centered security -- intervention -- software developer -- software security; Computer software -- Periodicals; Computer programming -- Periodicals; Computer programs -- Periodicals; 005.3
• DOI: 10.1002/spe.2774
• Languages: English
• ISSNs: 0038-0644

Abstract

Summary: Though some software development teams are highly effective at delivering security, others either do not care or do not have access to security experts to teach them how. Unfortunately, these latter teams are still responsible for the security of the systems they build: systems that are ever more important to ever more people. We propose that a series of lightweight interventions, six hours of facilitated workshops delivered over three months, can improve a team's motivation to consider security and awareness of assurance techniques, changing its security culture even when no security experts are involved. The interventions were developed after an Appreciative Inquiry and Grounded Theory survey of security professionals to find out what approaches work best. We tested the interventions in a participatory action research field study where we delivered the workshops to three software development organizations and evaluated their effectiveness through interviews beforehand, immediately afterwards, and after twelve months. We found that the interventions can be effective with teams with limited or no security experience and that improvement is long‐lasting. This approach and the learning points arising from the work here have the potential to be applied in many development teams, improving the security of software worldwide.