TWC: Medium: Collaborative: Developer Crowdsourcing: Capturing, Understanding, and Addressing Security-related Blind Spots in APIs

尽管安全界强调生产安全软件的重要性，但软件中的新安全漏洞数量每年都在增加。这项研究是基于这样一种假设，即软件漏洞是由误解或缺乏知识引起的，称为盲点，开发人员在构建系统时会经历这种情况。在构建系统时，开发人员通常更多地关注功能需求，而不是非功能需求，如安全性。因此，他们可以做出优先考虑功能的设计决策，而不会注意到这些决策造成的安全漏洞。今天，开发人员通常无法访问在开发过程中突出这些漏洞的有效软件工具。该研究识别了常见的开发盲点，目的是构建和评估实用的软件工具，帮助防止开发过程中的盲点，并检测已部署软件中的漏洞；为了捕捉开发人员在面临盲点时的推理，并识别共同的盲点特征，该研究将识别出的几个盲点转换为编程难题，并与解决这些难题的开发人员进行用户研究。对开发人员答案的统计分析确定了盲点之间的共同特征，对开发人员行为的观察指导工具的创建，以自动检测盲点并在开发人员经历盲点时警告开发人员。这些工具有两个互补的目标：(1)通过当场提示开发人员编写代码时潜在的盲点来防止盲点的发生，以及(2)通过检测可能因盲点而编写的代码来识别现有应用程序中的软件漏洞。这项研究在与开发人员的用户研究的背景下对这些新开发的工具进行了评估，产生了以下结果：(1)了解应用程序编程接口(API)中的盲点，以及开发人员在使用API编写代码时的注意和决策过程，(2)了解如何在没有习惯性和恼人的情况下现场通知开发人员有关盲点的信息，以便开发人员在编写代码时使用相关的安全信息，(3)创建开放源码的公开可用的开发人员工具，通知开发人员有关盲点并促进检测盲点造成的漏洞，以及(4)通过考虑开发人员的注意力和决策过程，制定更好的API设计指南，以最大限度地减少盲点。这项研究通过结合开发过程中的人的因素，解决了安全软件开发中的一个重要差距。鉴于我们的社会对软件应用程序的依赖程度越来越高，这一点尤为重要。

Despite an emphasis the security community places on the importance of producing secure software, the number of new security vulnerabilities in software increases every year. This research is based on the assumption that software vulnerabilities are caused by misunderstandings, or lack of knowledge, called blind spots, which the developers experience while they are building systems. When building systems, developers often focus more on functional requirements than on non-functional ones, such as security. Thus, they can make design decisions that prioritize functionality without noticing the security vulnerabilities these decisions create. Today, developers often have no access to effective software tools that highlight these vulnerabilities during development. This research identifies common developer blind spots with the goal of building and evaluating practical software tools that help prevent blind spots during development and detect vulnerabilities in deployed software.To capture developers' reasoning when faced with blind spots, and to identify common blind spot characteristics, this research converts several identified blind spots into programming puzzles, and conducts a user study with developers solving these puzzles. Statistical analysis of the developers' answers identifies common characteristics among blind spots, and the observations of developers' behaviors guide the creation of tools to automatically detect blind spots and to warn developers about them as developers experience them. The tools have two complementary goals: (1) prevent blind spots from occurring by cueing developers on-the-spot about potential blind spots as they write code, and (2) identify software vulnerabilities in existing applications by detecting code that may have been written as a result of a blind spot. This research evaluates these newly developed tools in the context of a user study with developers, producing the following outcomes: (1) understanding of blind spots in application programming interfaces (APIs), and of developers' attentional and decision processes when writing code using APIs, (2) understanding of how to notify, without habituation and annoyance, developers on-the-spot about blind spots so that relevant security information is used by developers while writing code, (3) creation of open-source, publicly available developer tools that notify developers about blind spots and facilitate detection of vulnerabilities caused by blind spots, and (4) development of guidelines for better API design to minimize blind spots by considering developers' attentional and decision processes. This research addresses an important gap in secure software development by incorporating the human factor of the development process. This is particularly crucial given our society's increasing dependence on software applications.