SaTC: CORE: Medium: Collaborative: Understanding Security in the Software Development Lifecycle: A Holistic, Mixed-Methods Approach

SaTC：核心：媒介：协作：了解软件开发生命周期中的安全性：整体的混合方法方法

• 批准号: 1801633
• 负责人: Xinming Ou
• 金额: $ 50万
• 依托单位: University of South Florida
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2018
• 资助国家: 美国
• 起止时间: 2018-09-01 至 2022-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1801633&HistoricalAwards=false
• 关键词: SaTC; CORE; Medium; Collaborative; Understanding

As software now pervades nearly every aspect of modern life, securing software is widely acknowledged as a critical problem. Although significant effort has gone into identifying flaws in software, as well as developing tools, libraries, and processes for detecting and mitigating these flaws during software development and maintenance, security problems remain pervasive. There has been comparatively little effort to empirically assess the effectiveness of existing tools and processes in realistic settings, and almost no effort to understand the root causes of professional developers making security errors. This lack of knowledge hinders the advancement of secure programming techniques that can effectively reduce the number of security bugs in deployed software. This research focuses on measuring and evaluating the effectiveness of particular approaches to securing software as carried out by typical developers. By combining anthropological observation of industrial development practice with experimental evaluation of tools and processes, this project will identify new or underappreciated approaches to improving software security in practice.The research includes four interdependent approaches: anthropological observation via long-term embedding in partner industrial software development teams; conducting and analyzing results from secure-programming contests that serve as quasi-experiments; controlled lab experiments; and analysis of open-source software artifacts. The anthropological approach produces deep insights through zero-proximity observation and reflection by fieldworkers, and competitions illuminate how differences in approach (language, tools, etc.) to a substantive problem correlate (quantitatively and qualitatively) with success or failure. Both of these approaches will generate hypotheses, which can then be tested via controlled lab experiments, as well as additional field, contest, and artifact observations. This combination of approaches leverages the strength of each in order to maximize both ecological and internal validity, offering the best chance to understand the real causes of (in)secure software development and offer effective guidance.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

由于软件现在几乎渗透到现代生活的方方面面，因此保护软件安全被广泛认为是一个关键问题。尽管在识别软件缺陷以及开发用于在软件开发和维护期间检测和减轻这些缺陷的工具、库和流程方面付出了巨大的努力，但安全问题仍然普遍存在。人们相对较少地在现实环境中凭经验评估现有工具和流程的有效性，并且几乎没有努力去理解专业开发人员犯安全错误的根本原因。这种知识的缺乏阻碍了安全编程技术的进步，而安全编程技术可以有效地减少已部署软件中的安全错误数量。这项研究的重点是衡量和评估典型开发人员所采取的保护软件的特定方法的有效性。通过将对工业发展实践的人类学观察与对工具和流程的实验评估相结合，该项目将确定在实践中提高软件安全性的新方法或未被充分重视的方法。该研究包括四种相互依赖的方法：通过长期嵌入合作伙伴工业软件开发团队进行人类学观察；进行和分析作为准实验的安全编程竞赛的结果；受控实验室实验；以及开源软件工件的分析。人类学方法通过田野工作人员的零接近观察和反思产生深刻的见解，而竞赛则阐明了解决实质性问题的方法（语言、工具等）的差异如何与成功或失败相关（定量和定性）。这两种方法都会产生假设，然后可以通过受控实验室实验以及额外的现场、竞赛和工件观察来测试这些假设。这种方法的组合利用了每种方法的优势，以最大限度地提高生态和内部有效性，提供了了解安全软件开发的真正原因并提供有效指导的最佳机会。该奖项反映了 NSF 的法定使命，并通过使用基金会的智力价值和更广泛的影响审查标准进行评估，被认为值得支持。

项目成果

An Analysis of the Role of Situated Learning in Starting a Security Culture in a Software Company

• 发表时间: 2021
• 作者: Anwesh Tuladhar;Daniel Lende;Jay Ligatti;Xinming Ou

An Ethnographic Understanding of Software (In)Security and a Co-Creation Model to Improve Secure Software Development

对软件（内）安全的民族志理解和改进安全软件开发的共同创建模型

• 发表时间: 2020
• 期刊: Proceedings of the Sixteenth Symposium on Usable Privacy and Security
• 作者: Palombo, Hernan;Ziaie Tabari, Armin;Lende, Daniel;Ligatti, Jay;Ou, Xinming
• 通讯作者: Ou, Xinming