Vulnerability Discovery for All: Experiences of Marginalization in Vulnerability Discovery
Vulnerability Discovery for All: Experiences of Marginalization in Vulnerability Discovery
复制标题
DOI：
10.1109/sp46215.2023.10179478
复制
发表时间：
2023-05
期刊：
影响因子：
--
通讯作者：
Kelsey R. Fulton;Samantha Katcher;Kevin Song;M. Chetty;Michelle L. Mazurek;Chloé Messdaghi;Daniel Votipka
中科院分区：
文献类型：
--
作者：
Kelsey R. Fulton;Samantha Katcher;Kevin Song;M. Chetty;Michelle L. Mazurek;Chloé Messdaghi;Daniel Votipka
漏洞发现是软件安全的一个重要方面。目前，对安全专家的需求大大超过了可用的漏洞发现工作人员。此外，现有的漏洞发现工作人员是高度同质的，由白色和亚洲男性主导。因此，提高漏洞发现社区能力的一个有希望的途径是从更广泛的人群中招募和保留。虽然以前的重要研究已经广泛地探讨了计算中的公平和包容性的挑战，但漏洞发现工作的竞争性和经常自学的性质可能会对这些挑战产生新的变化。本文报道了一个半结构化的访谈研究（N = 16）调查的人从边缘化的人群来参与漏洞发现，他们是否感到欢迎的漏洞发现社区，以及他们面临的挑战时，加入漏洞发现社区。我们发现，边缘化人口的成员面临着一些独特的挑战，而其他常见的脆弱性发现的挑战是由边缘化加剧。
Vulnerability discovery is an essential aspect of software security. Currently, the demand for security experts significantly exceeds the available vulnerability discovery workforce. Further, the existing vulnerability discovery workforce is highly homogeneous, dominated by white and Asian men. As such, one promising avenue for increasing the capacity of the vulnerability discovery community is through recruitment and retention from a broader population. Although significant prior research has explored the challenges of equity and inclusion in computing broadly, the competitive and frequently self-taught nature of vulnerability discovery work may create new variations on these challenges. This paper reports on a semi-structured interview study (N = 16) investigating how people from marginalized populations come to participate in vulnerability discovery, whether they feel welcomed by the vulnerability discovery community, and what challenges they face when joining the vulnerability discovery community. We find that members of marginalized populations face some unique challenges, while other challenges common in vulnerability discovery are exacerbated by marginalization.