Influences of developers' perspectives on their engagement with security in code

Awais Rashid; Bashar Nuseibeh; Irum Rauf; Tamara Lopez; Helen Sharp; Mark Levine; John Towse; Thein Tun; Marian Petre; Dirk van der Linden

doi:10.1145/3528579.3529180

Influences of developers' perspectives on their engagement with security in code

Awais Rashid
, Bashar Nuseibeh
, Irum Rauf
, Tamara Lopez
, Helen Sharp
, Mark Levine
, John Towse
, Thein Tun
, Marian Petre
, Dirk van der Linden

School of Computer Science

Research output: Chapter in Book/Report/Conference proceeding › Conference Contribution (Conference Proceeding)

10 Citations (Scopus)

Abstract

Background: Recent studies show that secure coding is about not only technical requirements but also developers' behaviour.

Objective: To understand the influence of socio-technical contexts on how developers attend to and engage with security in code, software engineering researchers collaborated with social psychologists on a psychologically-informed study.

Method: In a preregistered, between-group, controlled experiment, 124 developers from multiple freelance communities, were primed toward one of three identities, following which they completed code review tasks with open-ended responses. Qualitative analysis of the rich data focused on the attitudes and reasoning that shaped their identification of security issues within code.

Results: Overall, attention to code security was intermittent and heterogeneous in focus. Although social identity priming did not significantly change the code review, qualitative analysis revealed that developers varied in how they noticed issues in code, how they addressed them, and how they justified their choices.

Conclusion: We found that many developers do think about security - but differently from one another. Hence, effective interventions to promote secure coding must be appropriate to the individual development context.

Original language	English
Title of host publication	CHASE '22
Subtitle of host publication	Proceedings of the 15th International Conference on Cooperative and Human Aspects of Software Engineering
Publisher	Association for Computing Machinery
Pages	86-95
ISBN (Electronic)	9781450393423
DOIs	https://doi.org/10.1145/3528579.3529180
Publication status	Published - 19 Jul 2022
Event	ICSE '22: 44th International Conference on Software Engineering - Pittsburgh, United States Duration: 21 May 2022 → 29 May 2022 https://conf.researchr.org/home/icse-2022

Conference

Conference	ICSE '22
Country/Territory	United States
City	Pittsburgh
Period	21/05/22 → 29/05/22
Internet address	https://conf.researchr.org/home/icse-2022

Access to Document

10.1145/3528579.3529180Licence: Unspecified

https://researchportal.northumbria.ac.uk/en/publications/influences-of-developers-perspectives-on-their-engagement-with-se

Handle.net

Persistent link

Why Johnny doesn't write secure software? Secure software development by the masses
Rashid, A. (Principal Investigator) & Hallett, J. (Researcher)
1/10/18 → 31/12/21
Project: Research

Cite this

Rashid, A., Nuseibeh, B., Rauf, I., Lopez, T., Sharp, H., Levine, M., Towse, J., Tun, T., Petre, M., & van der Linden, D. (2022). Influences of developers' perspectives on their engagement with security in code. In CHASE '22: Proceedings of the 15th International Conference on Cooperative and Human Aspects of Software Engineering (pp. 86-95). Association for Computing Machinery. https://doi.org/10.1145/3528579.3529180

@inproceedings{683335d8effc40df9e0b6b9d6bf66261,

title = "Influences of developers' perspectives on their engagement with security in code",

abstract = "Background: Recent studies show that secure coding is about not only technical requirements but also developers' behaviour. Objective: To understand the influence of socio-technical contexts on how developers attend to and engage with security in code, software engineering researchers collaborated with social psychologists on a psychologically-informed study. Method: In a preregistered, between-group, controlled experiment, 124 developers from multiple freelance communities, were primed toward one of three identities, following which they completed code review tasks with open-ended responses. Qualitative analysis of the rich data focused on the attitudes and reasoning that shaped their identification of security issues within code. Results: Overall, attention to code security was intermittent and heterogeneous in focus. Although social identity priming did not significantly change the code review, qualitative analysis revealed that developers varied in how they noticed issues in code, how they addressed them, and how they justified their choices. Conclusion: We found that many developers do think about security - but differently from one another. Hence, effective interventions to promote secure coding must be appropriate to the individual development context.",

author = "Awais Rashid and Bashar Nuseibeh and Irum Rauf and Tamara Lopez and Helen Sharp and Mark Levine and John Towse and Thein Tun and Marian Petre and \{van der Linden\}, Dirk",

year = "2022",

month = jul,

day = "19",

doi = "10.1145/3528579.3529180",

language = "English",

pages = "86--95",

booktitle = "CHASE '22",

publisher = "Association for Computing Machinery",

address = "United States",

note = "<br/>ICSE '22 : 44th International Conference on Software Engineering ; Conference date: 21-05-2022 Through 29-05-2022",

url = "https://conf.researchr.org/home/icse-2022",

}

Rashid, A, Nuseibeh, B, Rauf, I, Lopez, T, Sharp, H, Levine, M, Towse, J, Tun, T, Petre, M & van der Linden, D 2022, Influences of developers' perspectives on their engagement with security in code. in CHASE '22: Proceedings of the 15th International Conference on Cooperative and Human Aspects of Software Engineering. Association for Computing Machinery, pp. 86-95,
ICSE '22, Pittsburgh, United States, 21/05/22. https://doi.org/10.1145/3528579.3529180

Influences of developers' perspectives on their engagement with security in code. / Rashid, Awais; Nuseibeh, Bashar; Rauf, Irum et al.
CHASE '22: Proceedings of the 15th International Conference on Cooperative and Human Aspects of Software Engineering. Association for Computing Machinery, 2022. p. 86-95.

Research output: Chapter in Book/Report/Conference proceeding › Conference Contribution (Conference Proceeding)

TY - GEN

T1 - Influences of developers' perspectives on their engagement with security in code

AU - Rashid, Awais

AU - Nuseibeh, Bashar

AU - Rauf, Irum

AU - Lopez, Tamara

AU - Sharp, Helen

AU - Levine, Mark

AU - Towse, John

AU - Tun, Thein

AU - Petre, Marian

AU - van der Linden, Dirk

PY - 2022/7/19

Y1 - 2022/7/19

N2 - Background: Recent studies show that secure coding is about not only technical requirements but also developers' behaviour. Objective: To understand the influence of socio-technical contexts on how developers attend to and engage with security in code, software engineering researchers collaborated with social psychologists on a psychologically-informed study. Method: In a preregistered, between-group, controlled experiment, 124 developers from multiple freelance communities, were primed toward one of three identities, following which they completed code review tasks with open-ended responses. Qualitative analysis of the rich data focused on the attitudes and reasoning that shaped their identification of security issues within code. Results: Overall, attention to code security was intermittent and heterogeneous in focus. Although social identity priming did not significantly change the code review, qualitative analysis revealed that developers varied in how they noticed issues in code, how they addressed them, and how they justified their choices. Conclusion: We found that many developers do think about security - but differently from one another. Hence, effective interventions to promote secure coding must be appropriate to the individual development context.

AB - Background: Recent studies show that secure coding is about not only technical requirements but also developers' behaviour. Objective: To understand the influence of socio-technical contexts on how developers attend to and engage with security in code, software engineering researchers collaborated with social psychologists on a psychologically-informed study. Method: In a preregistered, between-group, controlled experiment, 124 developers from multiple freelance communities, were primed toward one of three identities, following which they completed code review tasks with open-ended responses. Qualitative analysis of the rich data focused on the attitudes and reasoning that shaped their identification of security issues within code. Results: Overall, attention to code security was intermittent and heterogeneous in focus. Although social identity priming did not significantly change the code review, qualitative analysis revealed that developers varied in how they noticed issues in code, how they addressed them, and how they justified their choices. Conclusion: We found that many developers do think about security - but differently from one another. Hence, effective interventions to promote secure coding must be appropriate to the individual development context.

U2 - 10.1145/3528579.3529180

DO - 10.1145/3528579.3529180

M3 - Conference Contribution (Conference Proceeding)

SP - 86

EP - 95

BT - CHASE '22

PB - Association for Computing Machinery

T2 - <br/>ICSE '22

Y2 - 21 May 2022 through 29 May 2022

ER -

Influences of developers' perspectives on their engagement with security in code

Abstract

Conference

Access to Document

Handle.net

Fingerprint

Projects

Why Johnny doesn't write secure software? Secure software development by the masses

Cite this