Why Johnny doesn't write secure software? Secure software development by the masses

你是否使用移动或网络应用程序，或者在你的身上、家里或工作场所有物联网设备？你有没有想过是谁开发了驱动这些应用程序和设备的软件，他们对网络安全的理解是什么，他们是如何做出影响最终软件网络安全的设计决策的，哪些因素影响了他们的行为和设计选择？或者，您是利用应用程序开发平台和易于编程的硬件设备（如Arduino和Raspberry Pi）开发应用程序并将其部署到个人使用或分发给全球数百万人的大众中的一员？当你编写软件时，你是如何做出网络安全决策的？您是否有意识地考虑设计选择的安全性含义，或者是否存在其他更关键的因素？什么将帮助您从正在开发的软件中实现您的目标，同时确保它不容易受到恶意行为者的攻击？本项目旨在加深对这些问题的基本理解。我们认识到，开发软件不再是少数拥有深厚技术技能、培训和知识的人的专利。越来越多来自不同背景的人正在为移动和网络应用程序以及可编程消费设备开发软件。开发者的多样性是数字经济中许多创新的核心。他们生产的软件可以，并且已经部署在嵌入到人类活动的许多方面的系统中，并且被全球用户群使用。然而，目前对从事软件开发的“大众”的安全行为和决策过程知之甚少。我们用“Johnny”这个笔名来称呼这些人——这是基于Whitten和Tygar的开创性著作，他们在书中强调了Johnny（加密的原型用户）所面临的挑战。在这个项目中，我们的目标是解决Johnny在当代环境中所面临的挑战，而不是加密。我们关注的是拥有不同背景、专业知识和网络安全专业知识的约翰尼，他们能够并且正在开发全球数百万人使用的软件。利用网络安全、软件工程和心理学专家组成的研究团队，我们在这个项目中的目标是进行基于经验的研究，以更好地理解Johnny的行为和实践的安全含义，并为Johnny的安全软件开发提供有效的支持。我们建议通过揭示和描述Johnny倾向于引入的安全漏洞，通过分析这些漏洞是如何以及为什么引入的，以及通过识别和评估一系列干预措施来改善Johnny在软件开发过程中的安全行为来实现这一目标。为此，我们将与来自世界各地领先研究和实践组织的知名国际研究伙伴合作。该项目将首次研究影响Johnny网络安全决策的认知和社会过程之间的相互关系，它们对最终软件安全性的影响，以及可能引导Johnny在软件开发过程中做出更有效网络安全决策的新干预措施。

Do you use mobile or web apps or have Internet of Things devices on your person, in your home or workplace? Have you thought about who developed the software that drives these apps and devices, what was their understanding of cyber security, how did they make design decisions that impact the cyber security of the resulting software, and what factors influenced their behaviour and design choices? Or perhaps you are one of the masses exploiting app development platforms and easy-to-program hardware devices such as Arduino and Raspberry Pi to develop applications and deploy them for personal use or distribute them to millions of people around the world? How do you make cyber security decisions when you write software? Do you consciously think about the security implications of your design choices, or are there other factors that are more critical? What will help you achieve your goals from the software that you are developing while ensuring that it is not vulnerable to attacks by malicious actors?This project aims to develop a deep foundational understanding of these issues. We recognise that developing software is no longer the preserve for the select few with deep technical skills, training, and knowledge. A wide range of people from diverse backgrounds are increasingly developing software for mobile and web apps and for programmable consumer devices. This diversity of developers is at the heart of many innovations in the digital economy. The software they produce can be, and is, deployed across systems embedded in many aspects of human activity, and is used by a global user base. However, little is currently understood about the security behaviours and decision-making processes of 'the masses' engaged in software development. We refer to these masses by the pseudonym 'Johnny' - based on a seminal work by Whitten and Tygar where they highlighted the challenges faced by Johnny, the prototypical user of encryption. In this project we aim to tackle the challenges faced by Johnny in a contemporary setting beyond encryption. We focus on the Johnnys with diverse backgrounds, know-how and cyber security expertise who can, and are, developing software used, potentially, by millions worldwide. Drawing on a research team of experts in cyber security, software engineering, and psychology, our aim in this project is to conduct empirically-grounded research to better understand the security implications of Johnny's behaviours and practices and develop effective support for secure software development by Johnny. We propose to achieve this by uncovering and characterising the security vulnerabilities that Johnny tends to introduce, by analysing how and why these vulnerabilities are introduced, and by identifying and evaluating a range of interventions to improve Johnny's security behaviours during software development. We will do this in collaboration with eminent international research partners, drawn from leading research and practitioner organisations around the world. This project will be the first to study the inter-relationship between the cognitive and social processes that shape Johnny's cyber security decisions, their impact on the security of the resultant software and the novel interventions that may steer Johnny towards more effective cyber security decisions during software development.