Schrödinger's Security: Opening the Box on App Developers' Security Rationale

Dirk Van Der Linden; Pauline Anthonysamy; Bashar Nuseibeh; Thein Tan Tun; Marian Petre; Mark Levine; John N. Towse; Awais Rashid

doi:10.1145/3377811.3380394

Schrödinger's Security: Opening the Box on App Developers' Security Rationale

Dirk Van Der Linden, Pauline Anthonysamy, Bashar Nuseibeh, Thein Tan Tun, Marian Petre, Mark Levine, John N. Towse, Awais Rashid

Department of Computer Science

Research output: Chapter in Book/Report/Conference proceeding › Conference Contribution (Conference Proceeding)

30 Citations (Scopus)

414 Downloads (Pure)

Abstract

Research has established the wide variety of security failures in mobile apps, their consequences, and how app developers introduce or exacerbate them. What is not well known is why developers do so—what is the rationale underpinning the decisions they make which eventually strengthen or weaken app security? This is all the more complicated in modern app development’s increasingly diverse demographic: growing numbers of independent, solo, or small team developers who do not have the organizational structures and support that larger software development houses enjoy.

Through two studies, we open the box on developer rationale, by performing a holistic analysis of the rationale underpinning various activities in which app developers engage when developing an app.

The first study does so through a task-based study with app developers (N=44) incorporating six distinct tasks for which this developer demographic must take responsibility: setting up a development environment, reviewing code, seeking help, seeking testers, selecting an advertisement SDK, and software licensing. We found that, while on first glance in several activities participants seemed to prioritize security, only in the code task such prioritization was underpinned by a security rationale—indicating that development behavior perceived to be secure may only be an illusion until the box is opened on their rationale.

The second study confirms these findings through a wider survey of app developers (N=274) investigating to what extent they find the activities of the task-based study to affect their app’s security. In line with the task-based study, we found that developers perceived actively writing code and actively using external SDKs as the only security-relevant, while similarly disregarding other activities having an impact on app security.

Our results suggest the need for a stronger focus on the tasks and activities surrounding the coding task—all of which need to be underpinned by a security rationale. Without such a holistic focus, developers may write “secure code” but not produce “secure apps”.

Original language	English
Title of host publication	ICSE '20: Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering
Publisher	Institute of Electrical and Electronics Engineers (IEEE)
Pages	149-160
Number of pages	12
ISBN (Electronic)	978-1-4503-7121-6
DOIs	https://doi.org/10.1145/3377811.3380394
Publication status	Published - 1 Jun 2020
Event	The 42nd International Conference on Software Engineering - https://conf.researchr.org/home/icse-2020, Seoul, Korea, Republic of Duration: 23 May 2020 → 29 May 2020 Conference number: 42 https://conf.researchr.org/home/icse-2020

Publication series

Name
ISSN (Print)	2574-1926

Conference

Conference	The 42nd International Conference on Software Engineering
Abbreviated title	ICSE 2020
Country/Territory	Korea, Republic of
City	Seoul
Period	23/05/20 → 29/05/20
Internet address	https://conf.researchr.org/home/icse-2020

Research Groups and Themes

Cyber Security

Access to Document

10.1145/3377811.3380394

Full-text PDF (accepted author manuscript)
This is the author accepted manuscript (AAM). The final published version (version of record) is available online via Institute of Electrical and Electronics Engineers at https://dl.acm.org/doi/abs/10.1145/3377811.3380394 . Please refer to any applicable terms of use of the publisher.
Accepted author manuscript, 2.45 MB
Supplementary informationAccepted author manuscript, 1.26 MB

Handle.net

Persistent link

Cite this

Van Der Linden, D., Anthonysamy, P., Nuseibeh, B., Tun, T. T., Petre, M., Levine, M., Towse, J. N., & Rashid, A. (2020). Schrödinger's Security: Opening the Box on App Developers' Security Rationale. In ICSE '20: Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering (pp. 149-160). Institute of Electrical and Electronics Engineers (IEEE). https://doi.org/10.1145/3377811.3380394

@inproceedings{f43803de4ade488fbe1aa2e8ba30c201,

title = "Schr{\"o}dinger's Security: Opening the Box on App Developers' Security Rationale",

abstract = "Research has established the wide variety of security failures in mobile apps, their consequences, and how app developers introduce or exacerbate them. What is not well known is why developers do so—what is the rationale underpinning the decisions they make which eventually strengthen or weaken app security? This is all the more complicated in modern app development{\textquoteright}s increasingly diverse demographic: growing numbers of independent, solo, or small team developers who do not have the organizational structures and support that larger software development houses enjoy.Through two studies, we open the box on developer rationale, by performing a holistic analysis of the rationale underpinning various activities in which app developers engage when developing an app.The first study does so through a task-based study with app developers (N=44) incorporating six distinct tasks for which this developer demographic must take responsibility: setting up a development environment, reviewing code, seeking help, seeking testers, selecting an advertisement SDK, and software licensing. We found that, while on first glance in several activities participants seemed to prioritize security, only in the code task such prioritization was underpinned by a security rationale—indicating that development behavior perceived to be secure may only be an illusion until the box is opened on their rationale.The second study confirms these findings through a wider survey of app developers (N=274) investigating to what extent they find the activities of the task-based study to affect their app{\textquoteright}s security. In line with the task-based study, we found that developers perceived actively writing code and actively using external SDKs as the only security-relevant, while similarly disregarding other activities having an impact on app security.Our results suggest the need for a stronger focus on the tasks and activities surrounding the coding task—all of which need to be underpinned by a security rationale. Without such a holistic focus, developers may write “secure code” but not produce “secure apps”.",

author = "{Van Der Linden}, Dirk and Pauline Anthonysamy and Bashar Nuseibeh and Tun, {Thein Tan} and Marian Petre and Mark Levine and Towse, {John N.} and Awais Rashid",

year = "2020",

month = jun,

day = "1",

doi = "10.1145/3377811.3380394",

language = "English",

publisher = "Institute of Electrical and Electronics Engineers (IEEE)",

pages = "149--160",

booktitle = "ICSE '20: Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering",

address = "United States",

note = "The 42nd International Conference on Software Engineering, ICSE 2020 ; Conference date: 23-05-2020 Through 29-05-2020",

url = "https://conf.researchr.org/home/icse-2020",

}

Van Der Linden, D, Anthonysamy, P, Nuseibeh, B, Tun, TT, Petre, M, Levine, M, Towse, JN & Rashid, A 2020, Schrödinger's Security: Opening the Box on App Developers' Security Rationale. in ICSE '20: Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering. Institute of Electrical and Electronics Engineers (IEEE), pp. 149-160, The 42nd International Conference on Software Engineering, Seoul, Korea, Republic of, 23/05/20. https://doi.org/10.1145/3377811.3380394

Schrödinger's Security: Opening the Box on App Developers' Security Rationale. / Van Der Linden, Dirk; Anthonysamy, Pauline; Nuseibeh, Bashar et al.
ICSE '20: Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering. Institute of Electrical and Electronics Engineers (IEEE), 2020. p. 149-160.

Research output: Chapter in Book/Report/Conference proceeding › Conference Contribution (Conference Proceeding)

TY - GEN

T1 - Schrödinger's Security

T2 - The 42nd International Conference on Software Engineering

AU - Van Der Linden, Dirk

AU - Anthonysamy, Pauline

AU - Nuseibeh, Bashar

AU - Tun, Thein Tan

AU - Petre, Marian

AU - Levine, Mark

AU - Towse, John N.

AU - Rashid, Awais

N1 - Conference code: 42

PY - 2020/6/1

Y1 - 2020/6/1

N2 - Research has established the wide variety of security failures in mobile apps, their consequences, and how app developers introduce or exacerbate them. What is not well known is why developers do so—what is the rationale underpinning the decisions they make which eventually strengthen or weaken app security? This is all the more complicated in modern app development’s increasingly diverse demographic: growing numbers of independent, solo, or small team developers who do not have the organizational structures and support that larger software development houses enjoy.Through two studies, we open the box on developer rationale, by performing a holistic analysis of the rationale underpinning various activities in which app developers engage when developing an app.The first study does so through a task-based study with app developers (N=44) incorporating six distinct tasks for which this developer demographic must take responsibility: setting up a development environment, reviewing code, seeking help, seeking testers, selecting an advertisement SDK, and software licensing. We found that, while on first glance in several activities participants seemed to prioritize security, only in the code task such prioritization was underpinned by a security rationale—indicating that development behavior perceived to be secure may only be an illusion until the box is opened on their rationale.The second study confirms these findings through a wider survey of app developers (N=274) investigating to what extent they find the activities of the task-based study to affect their app’s security. In line with the task-based study, we found that developers perceived actively writing code and actively using external SDKs as the only security-relevant, while similarly disregarding other activities having an impact on app security.Our results suggest the need for a stronger focus on the tasks and activities surrounding the coding task—all of which need to be underpinned by a security rationale. Without such a holistic focus, developers may write “secure code” but not produce “secure apps”.

AB - Research has established the wide variety of security failures in mobile apps, their consequences, and how app developers introduce or exacerbate them. What is not well known is why developers do so—what is the rationale underpinning the decisions they make which eventually strengthen or weaken app security? This is all the more complicated in modern app development’s increasingly diverse demographic: growing numbers of independent, solo, or small team developers who do not have the organizational structures and support that larger software development houses enjoy.Through two studies, we open the box on developer rationale, by performing a holistic analysis of the rationale underpinning various activities in which app developers engage when developing an app.The first study does so through a task-based study with app developers (N=44) incorporating six distinct tasks for which this developer demographic must take responsibility: setting up a development environment, reviewing code, seeking help, seeking testers, selecting an advertisement SDK, and software licensing. We found that, while on first glance in several activities participants seemed to prioritize security, only in the code task such prioritization was underpinned by a security rationale—indicating that development behavior perceived to be secure may only be an illusion until the box is opened on their rationale.The second study confirms these findings through a wider survey of app developers (N=274) investigating to what extent they find the activities of the task-based study to affect their app’s security. In line with the task-based study, we found that developers perceived actively writing code and actively using external SDKs as the only security-relevant, while similarly disregarding other activities having an impact on app security.Our results suggest the need for a stronger focus on the tasks and activities surrounding the coding task—all of which need to be underpinned by a security rationale. Without such a holistic focus, developers may write “secure code” but not produce “secure apps”.

UR - https://conf.researchr.org/details/icse-2020/icse-2020-papers/24/Schr-dinger-s-Security-Opening-the-Box-on-App-Developers-Security-Rationale

U2 - 10.1145/3377811.3380394

DO - 10.1145/3377811.3380394

M3 - Conference Contribution (Conference Proceeding)

SP - 149

EP - 160

BT - ICSE '20: Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering

PB - Institute of Electrical and Electronics Engineers (IEEE)

Y2 - 23 May 2020 through 29 May 2020

ER -

Schrödinger's Security: Opening the Box on App Developers' Security Rationale

Abstract

Publication series

Conference

Research Groups and Themes

Access to Document

Handle.net

Other files and links

Fingerprint

Why Johnny doesn't write secure software? Secure software development by the masses

Professor Awais Rashid

Cite this

Schrödinger's Security: Opening the Box on App Developers' Security Rationale

Abstract

Publication series

Conference

Research Groups and Themes

Access to Document

Handle.net

Other files and links

Fingerprint

Projects

Why Johnny doesn't write secure software? Secure software development by the masses

Profiles

Professor Awais Rashid

Cite this