Home > Research > Publications & Outputs > The Case for Adaptive Security Interventions

Research

Associated organisational units

Electronic data

Links

Text available via DOI:

View graph of relations

The Case for Adaptive Security Interventions

Research output: Contribution to Journal/Magazine › Journal article › peer-review

Published

Standard

The Case for Adaptive Security Interventions. / Rauf, Irum; Petre, Marian; Tun, Thein T. et al.
In: ACM Transactions on Software Engineering and Methodology, Vol. 31, No. 1, 9, 31.01.2022, p. 1-52.

Research output: Contribution to Journal/Magazine › Journal article › peer-review

Harvard

Rauf, I, Petre, M, Tun, TT, Lopez, T, Lunn, P, van der Linden, D, Towse, J, Sharp, H, Levine, M, Rashid, A & Nuseibeh, B 2022, 'The Case for Adaptive Security Interventions', ACM Transactions on Software Engineering and Methodology, vol. 31, no. 1, 9, pp. 1-52. https://doi.org/10.1145/3471930

APA

Rauf, I., Petre, M., Tun, T. T., Lopez, T., Lunn, P., van der Linden, D., Towse, J., Sharp, H., Levine, M., Rashid, A., & Nuseibeh, B. (2022). The Case for Adaptive Security Interventions. ACM Transactions on Software Engineering and Methodology, 31(1), 1-52. Article 9. https://doi.org/10.1145/3471930

Vancouver

Rauf I, Petre M, Tun TT, Lopez T, Lunn P, van der Linden D et al. The Case for Adaptive Security Interventions. ACM Transactions on Software Engineering and Methodology. 2022 Jan 31;31(1):1-52. 9. Epub 2021 Sept 28. doi: 10.1145/3471930

Author

Rauf, Irum ; Petre, Marian ; Tun, Thein T. et al. / The Case for Adaptive Security Interventions. In: ACM Transactions on Software Engineering and Methodology. 2022 ; Vol. 31, No. 1. pp. 1-52.

Bibtex

@article{d2dd7edf16544edead7c547d56056d30,
title = "The Case for Adaptive Security Interventions",
abstract = "Despite the availability of various methods and tools to facilitate secure coding, developers continue to write code that contains common vulnerabilities. It is important to understand why technological advances do not sufficiently facilitate developers in writing secure code. In order to widen our understanding of developers{\textquoteright} behaviour, we considered the complexity of the security decision space of developers using theory from cognitive and social psychology. Our interdisciplinary study reported in this paper (1) draws on the psychology literature to provide conceptual underpinnings for three categories of impediments to achieving security goals, (2) reports on an in-depth meta-analysis of existing software security literature which identified a catalogue of factors that influence developers{\textquoteright} security decisions, and (3) characterises the landscape of existing security interventions that are available to the developer during coding and identifies gaps. Collectively, these show that different forms of impediments to achieving security goals arise from different contributing factors. Interventions will be more effective where they reflect psychological factors more sensitively and marry technical sophistication, psychological frameworks, and usability. Our analysis suggests {\textquoteleft}adaptive security interventions{\textquoteright} as a solution that responds to the changing security needs of individual developers and a present a proof-of-concept tool to substantiate our suggestion.",
author = "Irum Rauf and Marian Petre and Tun, {Thein T.} and Tamara Lopez and Paul Lunn and {van der Linden}, Dirk and John Towse and Helen Sharp and Mark Levine and Awais Rashid and Bashar Nuseibeh",
year = "2022",
month = jan,
day = "31",
doi = "10.1145/3471930",
language = "English",
volume = "31",
pages = "1--52",
journal = "ACM Transactions on Software Engineering and Methodology",
issn = "1049-331X",
publisher = "Association for Computing Machinery (ACM)",
number = "1",

}

RIS

TY - JOUR

T1 - The Case for Adaptive Security Interventions

AU - Rauf, Irum

AU - Petre, Marian

AU - Tun, Thein T.

AU - Lopez, Tamara

AU - Lunn, Paul

AU - van der Linden, Dirk

AU - Towse, John

AU - Sharp, Helen

AU - Levine, Mark

AU - Rashid, Awais

AU - Nuseibeh, Bashar

PY - 2022/1/31

Y1 - 2022/1/31

N2 - Despite the availability of various methods and tools to facilitate secure coding, developers continue to write code that contains common vulnerabilities. It is important to understand why technological advances do not sufficiently facilitate developers in writing secure code. In order to widen our understanding of developers’ behaviour, we considered the complexity of the security decision space of developers using theory from cognitive and social psychology. Our interdisciplinary study reported in this paper (1) draws on the psychology literature to provide conceptual underpinnings for three categories of impediments to achieving security goals, (2) reports on an in-depth meta-analysis of existing software security literature which identified a catalogue of factors that influence developers’ security decisions, and (3) characterises the landscape of existing security interventions that are available to the developer during coding and identifies gaps. Collectively, these show that different forms of impediments to achieving security goals arise from different contributing factors. Interventions will be more effective where they reflect psychological factors more sensitively and marry technical sophistication, psychological frameworks, and usability. Our analysis suggests ‘adaptive security interventions’ as a solution that responds to the changing security needs of individual developers and a present a proof-of-concept tool to substantiate our suggestion.

AB - Despite the availability of various methods and tools to facilitate secure coding, developers continue to write code that contains common vulnerabilities. It is important to understand why technological advances do not sufficiently facilitate developers in writing secure code. In order to widen our understanding of developers’ behaviour, we considered the complexity of the security decision space of developers using theory from cognitive and social psychology. Our interdisciplinary study reported in this paper (1) draws on the psychology literature to provide conceptual underpinnings for three categories of impediments to achieving security goals, (2) reports on an in-depth meta-analysis of existing software security literature which identified a catalogue of factors that influence developers’ security decisions, and (3) characterises the landscape of existing security interventions that are available to the developer during coding and identifies gaps. Collectively, these show that different forms of impediments to achieving security goals arise from different contributing factors. Interventions will be more effective where they reflect psychological factors more sensitively and marry technical sophistication, psychological frameworks, and usability. Our analysis suggests ‘adaptive security interventions’ as a solution that responds to the changing security needs of individual developers and a present a proof-of-concept tool to substantiate our suggestion.

U2 - 10.1145/3471930

DO - 10.1145/3471930

M3 - Journal article

VL - 31

SP - 1

EP - 52

JO - ACM Transactions on Software Engineering and Methodology

JF - ACM Transactions on Software Engineering and Methodology

SN - 1049-331X

IS - 1

M1 - 9

ER -