SaTC: CORE: Small: Risk-based Secure Checked-in Credential Reduction for Software Development

与人类用户类似，软件在很大程度上依赖于使用凭证（如密码）来证明身份和访问资源的权限。在软件开发期间，软件工程师可能需要共享这些软件凭证，并且部署软件的操作员通常需要将这些凭证安全地分发到服务器。工程师们可能会采取阻力最小的方法，包括在用于管理软件开发的分布式版本控制系统中存储凭证-密钥，数据库连接字符串，证书，用户名和密码。这种类型的存储使访问和分发这些凭证更加方便，但也会产生非常真实的危险，即它们将被泄露给公众或内部威胁。该项目将开发软件工程师如何选择管理凭证的理解，并将开发技术，工具，和数据集，以更好地检测凭据泄漏，并根据凭据泄露可能产生的风险优先删除凭据。该项目将包括对软件工程师整体决策中功能和安全问题相互作用的混合方法调查-制定用于保护或揭示软件工件中的凭证的策略。这个项目将告知我们的方法，以提高静态分析工具的能力，以更低的误报率检测更多的凭据。此外，该项目将识别受凭证保护的资产，这将实现自动或半自动的风险评估。最后，该项目将导致创建和评估新技术，用于在项目团队和系统中安全地存储和共享秘密。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Similar to human users, software relies heavily on the use of credentials, like passwords, to prove identity and rights to access resources. During software development, software engineers may need to share these software credentials, and operators who deploy the software will often need to distribute these credentials securely to servers. Engineers may take the path of least resistance which includes storing credentials -- keys, database connection strings, certificates, usernames and passwords -- in distributed version control systems used to manage software development. This type of storage makes accessing and distributing these credentials more convenient but also creates the very real hazard that they will be leaked to the public or to insider threats. This project will develop an understanding of how software engineers choose to manage credentials, and will develop techniques, tools, and datasets to better detect credential leaks and to prioritize credential removal based on the risks that disclosure of the credential would create.This project will include a mixed-methods investigation of the interplay of functional and security concerns on the software engineer's overall decision-making strategy for protecting or revealing credentials in software artifacts. This project will inform our approach to improve the ability of static analysis tools to detect more credentials with a lower false positive rate. Additionally, the project will identify the asset being protected by the credential, which will enable an automated or semi-automated risk estimation. Finally, the project will lead to the creation and evaluation of new techniques for securely storing and sharing secrets among project teams and in a system.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.