一句话：基于190余名工业开发者的调查，揭示安全编码指南认知与遵守不足，论证行业安全编码教育必要性并给出15项行动建议。
软件漏洞常可追溯至设计与编码缺陷，仅工业控制系统中的相关经济损失就超过3.8亿美元；尽管已有安全编码指南，开发者是否了解并遵守仍不明确。该研究关注人的因素，对190余名工业软件开发者开展大规模问卷调查，考察其对安全编码指南的认知、遵守情况及不遵守或不了解的原因。结果表明，工业开发者对安全编码指南的认知与合规存在不足，从而论证了在工业界开展安全编码教育的必要性。论文还给出15条可供从业者采用的行动项，并公开原始数据以支持后续研究。
The Department of Homeland Security in the United States estimates that 90% of software vulnerabilities can be traced back to defects in design and software coding. The financial impact of these vulnerabilities has been shown to exceed 380 million USD in industrial control systems alone. Since software developers write software, they also introduce these vulnerabilities into the source code. However, secure coding guidelines exist to prevent software developers from writing vulnerable code. This study focuses on the human factor, the software developer, and secure coding, in particular secure coding guidelines. We want to understand the software developers' awareness and compliance to secure coding guidelines and why, if at all, they aren't compliant or aware. We base our results on a large-scale survey on secure coding guidelines, with more than 190 industrial software developers. Our work's main contribution motivates the need to educate industrial software developers on secure coding guidelines, and it gives a list of fifteen actionable items to be used by practitioners in the industry. We also make our raw data openly available for further research.
@inproceedings{paperbot6253,
title = {Is Secure Coding Education in the Industry Needed? An Investigation Through a Large Scale Survey},
author = {Tiago Espinha Gasiba and Ulrike Lechner and Maria Pinto-Albuquerque and Daniel Méndez},
booktitle = {ICSE},
year = {2021},
doi = {10.1109/icse-seet52601.2021.00034}
}