Serious Coding: A Game Approach To Security For The New Code-Citizens

软件系统的安全是一个受组织、技术和人员影响的复杂问题。安全薄弱的影响的一个例子是2019年数据泄露成本报告，其中Ponemon Institute for IBM Security估计，在整个英国，数据泄露的平均成本从2018年的368万美元增加到2019年的388万美元(与其他地区相比，全球第六高成本)。GitLab于2019年7月15日发布的《2019年全球开发人员报告》证实了软件开发人员处于这个问题的前沿，该报告调查了超过4k名软件专业人员，发现69%的开发人员表示他们应该编写安全代码，近一半的开发人员表示他们很难让开发人员将修复漏洞作为优先事项，68%的安全专业人员认为只有不到一半的开发人员能够在生命周期的后期发现安全漏洞。这些戏剧性的数字是针对专业人士的，而庞大的移动和网络应用市场推动了软件开发和部署的民主化，这意味着这些应用中的许多不是由专业人士开发的。随着软件开发和部署的民主化，代码安全和安全问题也随之而来。这种民主化的核心是新的代码公民，他们通晓代码，能够构建和运行自己的软件代码。然而，他们可能没有接受过正式的软件工程培训，而且通常处于软件行业之外，而软件行业通常通过内部标准来灌输良好的实践。作为新公民，他们需要在一个与软件系统共存的社会中发现、理解并行使自己的权利和义务。他们对其编码的安全含义的理解对于软件系统的安全是至关重要的。最近的研究(Fischer等人，2017)显示，在包含来自Stack Overflow的安全相关代码片段的130万个Android应用程序中，97.9%包含至少一个不安全的代码片段。为了帮助这些代码公民成为安全的代码公民，我们相信我们可以使用严肃的游戏，这将把练习和游戏结合在一起，增强和引导我们的参与者专注。游戏是一种身临其境的媒介，该项目将使用它来吸引代码公民并提供对安全问题的干预。此外，设计严肃游戏的过程本身就引出了实践的本质，并使参与者参与定义如何干预和有效地采取行动。在这个项目中，我们建议通过让代码公民参与为代码公民设计严肃的游戏，将代码公民置于安全代码开发的核心。该项目将针对三个软件安全主题应用增强的严肃游戏设计，这三个主题已经得到了工业实践的启发。

The security of software systems is a complex problem impacted by organisation, technology and people. An example of the impact of weak security is shown by the 2019 Cost of a Data Breach report in which the Ponemon Institute for IBM Security estimated that across the United Kingdom, the average cost of a data breach increased from $3.68 million in 2018 to $3.88 million in 2019 (6th highest cost globally when compared to other regions). Software developers are at the forefront of the issue as confirmed by the GitLab's 2019 Global Developer Report released on 15th July 2019 (https://about.gitlab.com/developer-survey/2019/) which surveyed over 4k software professionals and found that while 69% of developers indicate they are expected to write secure code, nearly half said they struggle to get developers to make remediation of vulnerabilities a priority, and 68% of security professionals feel that fewer than half of developers are able to spot security vulnerabilities later in the lifecycle. These dramatic figures are for professionals while the democratisation of software development and deployment enabled by the enormous markets of mobile and Web apps means that many of these apps are not built by professionals. With the democratisation of software development and deployment, comes the widening of the issues of code security and safety. At the heart of this democratisation are the new code-citizens who are code- literate, able to build and run their own software code. However, they may have had no formal software engineering training and are often outside of the software industry which normally inculcate good practice via house standards. As new citizens, they need to discover, understand, and exercise their rights and duties among a society living with software systems. Their understanding of the security implications of their coding is of fundamental importance to the security of software systems. Recent research (Fischer et al, 2017) revealed that of the 1.3 million Android applications that contained security-related code snippets from Stack Overflow 97.9% contained at least one insecure code snippet. To assist these code-citizens to become secure code citizens we believe that we can use serious games, which will bring practice and play together to enhance and guide our participants focus. Games are an immersive medium which the project will use to engage code-citizens and deliver an intervention on security matters. Additionally, the process of designing serious games itself elicits the nature of the practice and engages participants in defining how to intervene and act effectively. We propose in this project to put code-citizens at the heart of secure code development by engaging code-citizens in the co-design of serious games for code-citizens. The project will apply an enhanced serious game design for three software security themes that have been informed by industrial practice.