DASP: A Framework for Driving the Adoption of Software Security Practices

Implementing software security practices is a critical concern in modern software development. Industry practitioners, security tool providers, and researchers have provided standard security guidelines and sophisticated security development tools to ensure a secure software development pipeline. Bu...

Full description

Saved in:
Bibliographic Details
Published in:IEEE transactions on software engineering 2023-04, Vol.49 (4), p.1-29
Main Authors: Larios-Vargas, Enrique, Elazhary, Omar, Yousefi, Soroush, Lowlind, Derek, Vliek, Michael L. W., Storey, Margaret-Anne
Format: Article
Language:English
Subjects:
Alliances
Behavior change
Behavioral sciences
Context modeling
Developer-centric security
Guidelines
Industrial development
Organizations
Psychology
Security
Software
Software development
Software security
Software security practices
Citations: Items that this one cites
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:Implementing software security practices is a critical concern in modern software development. Industry practitioners, security tool providers, and researchers have provided standard security guidelines and sophisticated security development tools to ensure a secure software development pipeline. But despite these efforts, there continues to be an increase in the number of vulnerabilities that can be exploited by malicious hackers. There is thus an urgent need to understand why developers still introduce security vulnerabilities into their applications and to understand what can be done to motivate them to write more secure code. To understand and address this problem further, we propose DASP, a framework for diagnosing and driving the adoption of software security practices among developers. DASP was conceived by combining behavioral science theories to shape a cross-sectional interview study with 28 software practitioners. Our interviews lead to a framework that consists of a comprehensive set of 33 drivers grouped into 7 higher-level categories that represent what needs to happen or change so that the adoption of software security practices occurs. Using the DASP framework, organizations can design interventions suitable for developers' specific development contexts that will motivate them to write more secure code.
ISSN:0098-5589
1939-3520
DOI:10.1109/TSE.2023.3235684