A Survey on Developer-Centred Security

Jun 1, 2019·
Mohammad Tahaei
Kami Vaniea
Kami Vaniea
· 0 min read
Abstract

Software developers are key players in the security ecosystem as they produce code that runs on millions of devices. Yet we continue to see insecure code being developed and deployed on a regular basis despite the existence of support infrastructures, tools, and research into common errors. This work provides a systematised overview of the relatively new field of Developer-Centred Security which aims to understand the context in which developers produce security-relevant code as well as provide tools and processes that that better support both developers and secure code production.

We report here on a systematic literature review of 49 publications on security studies with software developer participants. We provide an overview of both the types of methodologies currently being used as well as the current research in the area. Finally, we also provide recommendations for future work in Developer-Centred Security.

Type
Publication
In European Workshop on Usable Security (EuroUSEC) co-located with The IEEE European Symposium on Security and Privacy (EuroS&PW)
publication
Developer-Centered Security Security Developers Sok Survey Developer-Centered Privacy
Authors
Mohammad Tahaei (he/him)
Graduated PhD Student
Kami Vaniea
Authors
Kami Vaniea (she/her)
Associate Professor
I am an Associate Professor at the University of Waterloo’s Department of Electrical and Computer Engineering (ECE) where I head the Technology Usability Lab in Privacy and Security (TULiPS). The goal of my research is to make security and privacy technologies more accessible for a wide range of users including end users, developers, and system administrators. I believe that technology should support people in their activities. My recent projects include topics like patch management, developer-centered privacy, phishing, online anonymity, smart speaker privacy, and privacy on social media.