Studying Secure Coding in the Laboratory: Why, What, Where, How, and Who?

Ita Ryan; Klaas Jan Stol; Utz Roedig

doi:10.1109/EnCyCriS59249.2023.00008

Studying Secure Coding in the Laboratory: Why, What, Where, How, and Who?

School of Computer Science and Information Technology

Research output: Chapter in Book/Report/Conference proceedings › Conference proceeding › peer-review

Abstract

Software security is an area of growing concern, with over 192,000 known vulnerabilities in public software at the time of writing. Many aids to secure coding exist. Assessing the effectiveness of such aids in a laboratory environment is difficult. There are a number of concerns to address, such as recruitment issues and the level of instrumentation needed to perform an accurate measurement. Based on an extensive literature review of software development aids, we describe recent approaches to running laboratory studies, their characteristics, and their benefits and drawbacks. This paper should be of use to anyone planning to undertake coding studies with software developers.

Original language	English
Title of host publication	Proceedings - 2023 IEEE/ACM 4th International Workshop on Engineering and Cybersecurity of Critical Systems, EnCyCriS 2023
Publisher	Institute of Electrical and Electronics Engineers Inc.
Pages	23-30
Number of pages	8
ISBN (Electronic)	9798350338140
DOIs	https://doi.org/10.1109/EnCyCriS59249.2023.00008
Publication status	Published - 2023
Event	4th IEEE/ACM International Workshop on Engineering and Cybersecurity of Critical Systems, EnCyCriS 2023 - Melbourne, Australia Duration: 15 May 2023 → …

Publication series

Name	Proceedings - 2023 IEEE/ACM 4th International Workshop on Engineering and Cybersecurity of Critical Systems, EnCyCriS 2023

Conference

Conference	4th IEEE/ACM International Workshop on Engineering and Cybersecurity of Critical Systems, EnCyCriS 2023
Country/Territory	Australia
City	Melbourne
Period	15/05/23 → …

UN SDGs

This output contributes to the following UN Sustainable Development Goals (SDGs)

SDG 17 Partnerships for the Goals

Keywords

application security
secure application development
secure development
secure development lifecycle
secure development processes
secure development tools
secure programming
security issue
software developer
software programmer
Software security

Access to Document

10.1109/EnCyCriS59249.2023.00008

Cite this

Ryan, I., Stol, K. J., & Roedig, U. (2023). Studying Secure Coding in the Laboratory: Why, What, Where, How, and Who? In Proceedings - 2023 IEEE/ACM 4th International Workshop on Engineering and Cybersecurity of Critical Systems, EnCyCriS 2023 (pp. 23-30). (Proceedings - 2023 IEEE/ACM 4th International Workshop on Engineering and Cybersecurity of Critical Systems, EnCyCriS 2023). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/EnCyCriS59249.2023.00008

Ryan, Ita ; Stol, Klaas Jan ; Roedig, Utz. / Studying Secure Coding in the Laboratory : Why, What, Where, How, and Who?. Proceedings - 2023 IEEE/ACM 4th International Workshop on Engineering and Cybersecurity of Critical Systems, EnCyCriS 2023. Institute of Electrical and Electronics Engineers Inc., 2023. pp. 23-30 (Proceedings - 2023 IEEE/ACM 4th International Workshop on Engineering and Cybersecurity of Critical Systems, EnCyCriS 2023).

@inproceedings{b3e948e57ce241e3b5b88bff19c6c5f9,

title = "Studying Secure Coding in the Laboratory: Why, What, Where, How, and Who?",

abstract = "Software security is an area of growing concern, with over 192,000 known vulnerabilities in public software at the time of writing. Many aids to secure coding exist. Assessing the effectiveness of such aids in a laboratory environment is difficult. There are a number of concerns to address, such as recruitment issues and the level of instrumentation needed to perform an accurate measurement. Based on an extensive literature review of software development aids, we describe recent approaches to running laboratory studies, their characteristics, and their benefits and drawbacks. This paper should be of use to anyone planning to undertake coding studies with software developers.",

keywords = "application security, secure application development, secure development, secure development lifecycle, secure development processes, secure development tools, secure programming, security issue, software developer, software programmer, Software security",

author = "Ita Ryan and Stol, \{Klaas Jan\} and Utz Roedig",

note = "Publisher Copyright: {\textcopyright} 2023 IEEE.; 4th IEEE/ACM International Workshop on Engineering and Cybersecurity of Critical Systems, EnCyCriS 2023 ; Conference date: 15-05-2023",

year = "2023",

doi = "10.1109/EnCyCriS59249.2023.00008",

language = "English",

series = "Proceedings - 2023 IEEE/ACM 4th International Workshop on Engineering and Cybersecurity of Critical Systems, EnCyCriS 2023",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

pages = "23--30",

booktitle = "Proceedings - 2023 IEEE/ACM 4th International Workshop on Engineering and Cybersecurity of Critical Systems, EnCyCriS 2023",

address = "United States",

}

Ryan, I , Stol, KJ & Roedig, U 2023, Studying Secure Coding in the Laboratory: Why, What, Where, How, and Who? in Proceedings - 2023 IEEE/ACM 4th International Workshop on Engineering and Cybersecurity of Critical Systems, EnCyCriS 2023. Proceedings - 2023 IEEE/ACM 4th International Workshop on Engineering and Cybersecurity of Critical Systems, EnCyCriS 2023, Institute of Electrical and Electronics Engineers Inc., pp. 23-30, 4th IEEE/ACM International Workshop on Engineering and Cybersecurity of Critical Systems, EnCyCriS 2023, Melbourne, Australia, 15/05/23. https://doi.org/10.1109/EnCyCriS59249.2023.00008

Studying Secure Coding in the Laboratory: Why, What, Where, How, and Who? / Ryan, Ita ; Stol, Klaas Jan ; Roedig, Utz.
Proceedings - 2023 IEEE/ACM 4th International Workshop on Engineering and Cybersecurity of Critical Systems, EnCyCriS 2023. Institute of Electrical and Electronics Engineers Inc., 2023. p. 23-30 (Proceedings - 2023 IEEE/ACM 4th International Workshop on Engineering and Cybersecurity of Critical Systems, EnCyCriS 2023).

Research output: Chapter in Book/Report/Conference proceedings › Conference proceeding › peer-review

TY - GEN

T1 - Studying Secure Coding in the Laboratory

T2 - 4th IEEE/ACM International Workshop on Engineering and Cybersecurity of Critical Systems, EnCyCriS 2023

AU - Ryan, Ita

AU - Stol, Klaas Jan

AU - Roedig, Utz

PY - 2023

Y1 - 2023

N2 - Software security is an area of growing concern, with over 192,000 known vulnerabilities in public software at the time of writing. Many aids to secure coding exist. Assessing the effectiveness of such aids in a laboratory environment is difficult. There are a number of concerns to address, such as recruitment issues and the level of instrumentation needed to perform an accurate measurement. Based on an extensive literature review of software development aids, we describe recent approaches to running laboratory studies, their characteristics, and their benefits and drawbacks. This paper should be of use to anyone planning to undertake coding studies with software developers.

AB - Software security is an area of growing concern, with over 192,000 known vulnerabilities in public software at the time of writing. Many aids to secure coding exist. Assessing the effectiveness of such aids in a laboratory environment is difficult. There are a number of concerns to address, such as recruitment issues and the level of instrumentation needed to perform an accurate measurement. Based on an extensive literature review of software development aids, we describe recent approaches to running laboratory studies, their characteristics, and their benefits and drawbacks. This paper should be of use to anyone planning to undertake coding studies with software developers.

KW - application security

KW - secure application development

KW - secure development

KW - secure development lifecycle

KW - secure development processes

KW - secure development tools

KW - secure programming

KW - security issue

KW - software developer

KW - software programmer

KW - Software security

UR - https://www.scopus.com/pages/publications/85168652088

U2 - 10.1109/EnCyCriS59249.2023.00008

DO - 10.1109/EnCyCriS59249.2023.00008

M3 - Conference proceeding

AN - SCOPUS:85168652088

T3 - Proceedings - 2023 IEEE/ACM 4th International Workshop on Engineering and Cybersecurity of Critical Systems, EnCyCriS 2023

SP - 23

EP - 30

BT - Proceedings - 2023 IEEE/ACM 4th International Workshop on Engineering and Cybersecurity of Critical Systems, EnCyCriS 2023

PB - Institute of Electrical and Electronics Engineers Inc.

Y2 - 15 May 2023

ER -

Ryan I , Stol KJ , Roedig U. Studying Secure Coding in the Laboratory: Why, What, Where, How, and Who? In Proceedings - 2023 IEEE/ACM 4th International Workshop on Engineering and Cybersecurity of Critical Systems, EnCyCriS 2023. Institute of Electrical and Electronics Engineers Inc. 2023. p. 23-30. (Proceedings - 2023 IEEE/ACM 4th International Workshop on Engineering and Cybersecurity of Critical Systems, EnCyCriS 2023). doi: 10.1109/EnCyCriS59249.2023.00008

Studying Secure Coding in the Laboratory: Why, What, Where, How, and Who?

Abstract

Publication series

Conference

UN SDGs

Keywords

Access to Document

Other files and links

Fingerprint

Cite this