SCIENCE@home

Security Notifications in Static Analysis Tools: Developers’ Attitudes, Comprehension, and Ability to Act on Them

Mohammad Tahaei,Kami Vaniea,K. Beznosov,M. Wolters

Published 2021 in International Conference on Human Factors in Computing Systems

ABSTRACT

Static analysis tools (SATs) have the potential to assist developers in finding and fixing vulnerabilities in the early stages of software development, requiring them to be able to understand and act on tools’ notifications. To understand how helpful such SAT guidance is to developers, we ran an online experiment (N=132) where participants were shown four vulnerable code samples (SQL injection, hard-coded credentials, encryption, and logging sensitive data) along with SAT guidance, and asked to indicate the appropriate fix. Participants had a positive attitude towards both SAT notifications and particularly liked the example solutions and vulnerable code. Seeing SAT notifications also led to more detailed open-ended answers and slightly improved code correction answers. Still, most SAT (SpotBugs 67%, SonarQube 86%) and Control (96%) participants answered at least one code-correction question incorrectly. Prior software development experience, perceived vulnerability severity, and answer confidence all positively impacted answer accuracy.

PUBLICATION RECORD

  • Publication year

    2021

  • Venue

    International Conference on Human Factors in Computing Systems

  • Publication date

    2021-05-06

  • Fields of study

    Computer Science

  • Identifiers
    DOI 10.1145/3411764.3445616
  • External record

    Open on Semantic Scholar

  • Source metadata

    Semantic Scholar

CITATION MAP

EXTRACTION MAP

CLAIMS

  • No claims are published for this paper.

CONCEPTS

  • No concepts are published for this paper.

REFERENCES

Showing 1-94 of 94 references · Page 1 of 1

CITED BY

Showing 1-38 of 38 citing papers · Page 1 of 1