Studying secure coding in the laboratory: Why, what, where, how, and who?
Software security is an area of growing concern, with over 191,000 known vulnerabilities in public software at the time of writing. Many aids to secure coding exist. Assessing the effectiveness of such aids in a laboratory environment is difficult. There are a number of concerns to address, such as recruitment issues and the level of instrumentation needed to perform an accurate measurement. Based on an extensive literature review of software development aids, we describe recent approaches to running laboratory studies, their characteristics, and their benefits and drawbacks. This paper should be of use to anyone planning to undertake coding studies with software developers. Index Terms—Software security, secure development tools, secure development processes, secure development, software programmer, software developer, application security, security issue, secure programming, secure application development, secure development lifecycle.
Software security , Secure coding
Ryan, I., Stol, K.-J. and Roedig, U. (2023) ‘Studying secure coding in the laboratory: why, what, where, how, and who?’, 2023 IEEE/ACM 4th International Workshop on Engineering and Cybersecurity of Critical Systems (EnCyCriS). Melbourne, Australia, 15 May, pp. 23–30. doi: 10.1109/EnCyCriS59249.2023.00008