Organizational practices in cryptographic development and testing
Organizational practices in cryptographic development and testing
复制标题
DOI：
10.1109/cns.2017.8228643
复制
发表时间：
2017-10
期刊：
影响因子：
--
通讯作者：
Julie M. Haney;S. Garfinkel;M. Theofanos
中科院分区：
文献类型：
--
作者：
Julie M. Haney;S. Garfinkel;M. Theofanos
开发加密产品的组织面临着重大挑战，包括可用性和人为因素，这可能导致安全性降低，开发时间增加，并错过了充分利用技术潜力的机会。为了更好地识别这些挑战，我们通过对121名代表参与包括加密在内的产品开发的组织的个人进行基于Web的调查，探索了加密开发和测试实践。我们发现，参与者使用密码学的目的非常广泛，大多数都依赖于普遍接受的基于标准的实现作为指导。然而，许多人也开发了自己的实现，并利用基于非标准的资源来通知他们的开发和测试过程。我们的研究结果还强调了将加密技术纳入产品中在组织内部产生的挑战，包括人才的招聘和管理，产品生命周期以及向客户解释产品安全价值的能力。最后，我们讨论这些发现的影响和未来的研究机会。
Organizations developing cryptographic products face significant challenges, including usability and human factors, that may result in decreased security, increased development time, and missed opportunities to use the technology to its fullest potential. To better identify these challenges, we explored cryptographic development and testing practices by conducting a web-based survey of 121 individuals representing organizations involved in the development of products that include cryptography. We found that participants used cryptography for a wide range of purposes, with most relying on generally accepted, standards-based implementations as guides. However, many also developed their own implementations and drew on nonstandards based resources to inform their development and testing processes. Our results also highlight challenges that incorporating cryptography within products creates within organizations, including the recruitment and management of talent, the product lifecycle, and the ability to explain the security value of products to customers. We conclude by discussing implications of these findings and opportunities for future research.