Serious Coding: A Game Approach To Security For The New Code-Citizens

软件系统的安全性是一个复杂的问题，受到组织、技术和人员的影响。2019年数据泄露成本报告显示了安全性弱的影响的一个例子，其中IBM安全波耐蒙研究所估计，在英国，数据泄露的平均成本从2018年的368万美元增加到2019年的388万美元（与其他地区相比，全球成本第六高）。正如GitLab于2019年7月15日发布的2019年全球开发者报告（https://about.gitlab.com/developer-survey/2019/）所证实的那样，软件开发人员处于这个问题的最前沿，该报告调查了超过4k名软件专业人员，发现虽然69%的开发人员表示他们希望编写安全代码，但近一半的开发人员表示他们很难让开发人员将漏洞修复作为优先事项。68%的安全专业人员认为，只有不到一半的开发人员能够在生命周期的后期发现安全漏洞。这些戏剧性的数字是针对专业人士的，而由移动和Web应用程序的巨大市场推动的软件开发和部署的民主化意味着许多这些应用程序不是由专业人士构建的。随着软件开发和部署的民主化，随之而来的是代码安全和安全问题的扩大。这种民主化的核心是新的代码公民，他们具有代码素养，能够构建和运行自己的软件代码。然而，他们可能没有接受过正式的软件工程培训，并且通常不在通常通过内部标准灌输良好实践的软件行业之外。作为新公民，他们需要在一个与软件系统共存的社会中发现、理解并行使他们的权利和义务。他们对编码的安全性含义的理解对软件系统的安全性至关重要。最近的研究（Fischer et al, 2017）显示，在包含Stack Overflow安全相关代码片段的130万个Android应用程序中，97.9%至少包含一个不安全的代码片段。为了帮助这些代码公民成为安全的代码公民，我们相信我们可以使用严肃的游戏，这将把实践和游戏结合在一起，以增强和指导我们的参与者的注意力。游戏是一种沉浸式的媒介，该项目将利用它来吸引代码公民，并在安全问题上提供干预。此外，设计严肃游戏的过程本身引出了实践的本质，并让参与者定义如何有效地干预和行动。在这个项目中，我们建议通过让代码公民参与为代码公民设计的严肃游戏，将代码公民置于安全代码开发的核心。该项目将采用强化的严肃游戏设计，为三个软件安全主题，已告知工业实践。

The security of software systems is a complex problem impacted by organisation, technology and people. An example of the impact of weak security is shown by the 2019 Cost of a Data Breach report in which the Ponemon Institute for IBM Security estimated that across the United Kingdom, the average cost of a data breach increased from $3.68 million in 2018 to $3.88 million in 2019 (6th highest cost globally when compared to other regions). Software developers are at the forefront of the issue as confirmed by the GitLab's 2019 Global Developer Report released on 15th July 2019 (https://about.gitlab.com/developer-survey/2019/) which surveyed over 4k software professionals and found that while 69% of developers indicate they are expected to write secure code, nearly half said they struggle to get developers to make remediation of vulnerabilities a priority, and 68% of security professionals feel that fewer than half of developers are able to spot security vulnerabilities later in the lifecycle. These dramatic figures are for professionals while the democratisation of software development and deployment enabled by the enormous markets of mobile and Web apps means that many of these apps are not built by professionals. With the democratisation of software development and deployment, comes the widening of the issues of code security and safety. At the heart of this democratisation are the new code-citizens who are code- literate, able to build and run their own software code. However, they may have had no formal software engineering training and are often outside of the software industry which normally inculcate good practice via house standards. As new citizens, they need to discover, understand, and exercise their rights and duties among a society living with software systems. Their understanding of the security implications of their coding is of fundamental importance to the security of software systems. Recent research (Fischer et al, 2017) revealed that of the 1.3 million Android applications that contained security-related code snippets from Stack Overflow 97.9% contained at least one insecure code snippet. To assist these code-citizens to become secure code citizens we believe that we can use serious games, which will bring practice and play together to enhance and guide our participants focus. Games are an immersive medium which the project will use to engage code-citizens and deliver an intervention on security matters. Additionally, the process of designing serious games itself elicits the nature of the practice and engages participants in defining how to intervene and act effectively. We propose in this project to put code-citizens at the heart of secure code development by engaging code-citizens in the co-design of serious games for code-citizens. The project will apply an enhanced serious game design for three software security themes that have been informed by industrial practice.