An Analysis of the Role of Situated Learning in Starting a Security Culture in a Software Company
An Analysis of the Role of Situated Learning in Starting a Security Culture in a Software Company
复制标题
DOI：
--
复制
发表时间：
2021
期刊：
影响因子：
--
通讯作者：
Anwesh Tuladhar;Daniel Lende;Jay Ligatti;Xinming Ou
中科院分区：
文献类型：
--
作者：
Anwesh Tuladhar;Daniel Lende;Jay Ligatti;Xinming Ou
我们对一家软件开发公司进行了一项人种学研究，以探索开发团队是否以及如何在开发生命周期中采用安全实践。一名之前接受过定性研究方法培训的计算机科学博士生在该公司工作了8个月。研究人员以软件工程师的身份加入公司，并以新员工的身份参与所有开发活动，同时还对开发实践进行观察。在现场工作期间，我们观察到开发团队在安全开发方面的实践发生了积极的转变。我们对数据的分析表明，这种转变可以归因于使所有软件工程师看到如何将安全知识应用于他们所从事的特定软件产品。我们还观察到，通过与其他开发人员合作，在构建软件产品的具体环境下应用安全知识，拥有安全专业知识并希望推动更安全的开发实践的开发人员（安全倡导者）可以有效地实现这一目标。我们的数据指向一个交互式学习过程，在这个过程中，开发团队中的软件工程师获得知识，将其应用于实践，并为团队做出贡献，从而创建一组首选的实践，或者团队的“文化”。这个学习过程可以通过情境学习框架的视角来理解，在这个框架中，人们认识到知识转移发生在实践社区中，应用知识是个人（软件工程师）获取知识和社区（开发团队）在实践中体现这些知识的关键。我们的数据
We conducted an ethnographic study of a software development company to explore if and how a development team adopts security practices into the development lifecycle. A PhD student in computer science with prior training in qualitative research methods was embedded in the company for eight months. The researcher joined the company as a software engineer and participated in all development activities as a new hire would, while also making observations on the development practices. During the fieldwork, we observed a positive shift in the development team’s practices regarding secure development. Our analysis of data indicates that the shift can be attributed to enabling all software engineers to see how security knowledge could be applied to the specific software products they worked on. We also observed that by working with other developers to apply security knowledge under the concrete context where the software products were built, developers who possessed security expertise and wanted to push for more secure development practices (security advocates) could be effective in achieving this goal. Our data point to an interactive learning process where software engineers in a development team acquire knowledge, apply it in practice, and contribute to the team, leading to the creation of a set of preferred practices, or “culture” of the team. This learning process can be understood through the lens of the situated learning framework, where it is recognized that knowledge transfer happens within a community of practice, and applying the knowledge is the key in individuals (software engineers) acquiring it and the community (development team) embodying such knowledge in its practice. Our data