Towards Eective Adoption of Security Practices

Security tools guide so‰ware developers to identify potential vulnerabilities in their codes. However, the use of security tools is not common among developers. Œe goal of this research is to develop a framework for modeling the adoption of security practices in so‰ware development, and explore various sanctioning mechanisms in promoting greater adoption of these practices among developers. We propose a multiagent simulation framework that incorporates developers and manager roles, where developers try to maximize task completion and security compliance and the manager enforces sanctions based on functionality and security of the task outcome. Œe adoption of security practices emerge through the interaction of manager and developer agents in time-critical projects. Using the framework, we evaluated the adoption of security practices for developers with di‚erent preferences and strategies under individual and group sanctions. Œe model will improve understanding of the adoption of security tools and provide guidance to identify appropriate sanctioning mechanisms for increasing the adoption in so‰ware development. ACM Reference format: Paper *** . 2016. Towards E‚ective Adoption of Security Practices. In Proceedings of ACM Conference, Washington, DC, USA, July 2017 (Conference’17),