Projects per year
Abstract / Description of output
Static analysis tools (SATs) have the potential to assist developers in finding and fixing vulnerabilities in the early stages of software development, requiring them to be able to understand and act on tools’ notifications. To understand how helpful such SAT guidance is to developers, we ran an online experiment (N=132) where participants were shown four vulnerable code samples (SQL injection, hard-coded credentials, encryption, and logging sensitive data) along with SAT guidance, and asked to indicate the appropriate fix. Participants had a positive attitude towards both SAT notifications and particularly liked the example solutions and vulnerable code. Seeing SAT notifications also led to more detailed open-ended answers and slightly improved code correction answers. Still, most SAT (SpotBugs 67%, SonarQube 86%) and Control (96%) participants answered at least one code-correction question incorrectly. Prior software development experience, perceived vulnerability severity, and answer confidence all positively impacted answer accuracy.
Original language | English |
---|---|
Title of host publication | Proceedings of the SIGCHI Conference on Human Factors in Computing Systems |
Publisher | Association for Computing Machinery (ACM) |
Pages | 1-17 |
Number of pages | 17 |
ISBN (Print) | 9781450380966 |
DOIs | |
Publication status | Published - 6 May 2021 |
Event | The ACM CHI Conference on Human Factors in Computing Systems 2021 - Virtual Conference, Japan Duration: 8 May 2021 → 13 May 2021 https://chi2021.acm.org/ |
Conference
Conference | The ACM CHI Conference on Human Factors in Computing Systems 2021 |
---|---|
Abbreviated title | CHI 2021 |
Country/Territory | Japan |
City | Virtual Conference |
Period | 8/05/21 → 13/05/21 |
Internet address |
Keywords / Materials (for Non-textual outputs)
- usable security
- software developers
- security notifications
- static analysis tools
Fingerprint
Dive into the research topics of 'Security Notifications in Static Analysis Tools: Developers' Attitudes, Comprehension, and Ability to Act on Them'. Together they form a unique fingerprint.Projects
- 1 Finished
-
Improving the Usability of TLS APIs
Vaniea, K. & Tahaei, M.
UK industry, commerce and public corporations
1/05/18 → 30/04/22
Project: Research