Many real-world security vulnerabilities in software relate to a few known classes of attack such as code injection. Secure coding practices and technologies for detecting and preventing vulnerabilities in software are likewise established, such as input sanitisation and non-escaping strings. However, it is not clear why many professional software developers do not adopt these practices and technologies as a matter of course. This project examines the role developer motivation plays in the production of secure code.

Motivation significantly influences productivity and code quality in software development projects. Successful developers are motivated to learn new technologies, but are rarely motivated by reading documentation or studying manuals. They engage in peer-to-peer interactions and assessments, two forms of interaction that have been found to bring about lasting cultural change within the wider software developer community. This is evident, for example, in the widespread adoption of object-oriented technologies and agile development practices.

Motivating Jenny will investigate how to initiate and sustain secure software culture, building upon frameworks of personal motivation and team culture (see Figure 1). Two specific aims are to:

Figure 1 MOCC Model: Motivators, Outcomes, Characteristics and Context
  • A1. Develop an empirically-grounded model of why and how non-specialist developers can be motivated to adopt secure coding practices and technologies into their software development practice.
  • A2. Develop guidelines for creating and propagating a security culture across software teams.

To address these research aims, we will conduct ethnographic and constrained task studies and draw upon classic models of motivation, organisational theory, and social and cultural pyschology. Our engagement with the developer community will consider online and professional settings, in communities such as those found in StackExchange and through collaboration with a range of companies including members of Agile Business Consortium (ABC) Ltd and international partners in Ireland, Brazil and Japan.

This is a joint project between The Open University and Exeter University, and is a sister project of the EPSRC-funded Why Johnny doesn’t write secure software? Secure Software Development by the masses.

  • Invited Talk: Helen Sharp presented Secure code development in practice: Community and Culture at the Security Lancaster Seminar Series, 30 January, 2019.
  • Invited Talk: Tamara Lopez and Helen Sharp presented Secure Code Development in Practice at the Mini-SPA 2018 in Leeds on 26th November 2018
  • Workshop: Tamara Lopez, Helen Sharp and Thein Tun gave a workshop on Secure Code Development in Practice at the SPA Conference in London on 2 July 2018
  • Workshop: Tamara Lopez gave a paper at the First International Workshop on Security Awareness from Design to Deployment (SEAD'18) at ICSE 2018 in Gothenburg, Sweden on 27th May 2018
  • Workshop: Helen Sharp presented early findings at the International Workshop on Secure Software Engineering in DevOps and Agile Development at XP 2018 in Porto, Portugal, on 25 May 2018
  • Community Meeting: Tamara Lopez gave a lightning talk and Helen Sharp participated in a panel at the RISCS Community Meeting, UCL, 8 February 2018
  • XP Meetup London: Helen Sharp and Tamara Lopez gave a talk about security and motivation, 30 November 2017
  • Invited Talk: Helen Sharp, Motivating Jenny to Write Secure Software: Community and Culture of Coding, RISCS Community Meeting, UCL, 22 June 2017
  • Panel: Helen Sharp and Bashar Nuseibeh, Every little helps? Supporting the transition to secure software development processes, RISCS Community Meeting, UCL, 22 June 2017

Related Publications