Honours Thesis (BE Honours)

Software Developer behaviour Best Practices and their Impact on Static Analysis Security Defects

By Matthew Strasiotto

Supervised by: Rahul Gopinath, Yash Srivastava, Ralf Huuck

Abstract

Background

Software security is a domain of growing importance, as highlighted by the growing number of Common Vulnerabilities and Exposures (CVE) reported to the National Vulnerability Database every year [1]. Static analysis based security testing (SAST) is a tool that is commonly used to help detect software security defects as part of the automated software security testing suite [2]. Implementation and enforcement of “best practices” within the the development cycle is widely established to be instrumental in reducing software defects [3]. What is less known is how significantly does adherence of developer best practices contribute to the reduction of software security defects.

Research Problem

The purpose of the study is to explore the impact of software developer behavior / best practices on security defect findings.

Research Questions

  1. How can we detect vulnerabilities in a codebase?
  2. What aspects of developer behaviour are correlated or anti-correlated with vulnerabilities?
  3. What subset of those aspects can be monitored in a project?

We aim to answer these research questions with a paper consisting of two parts:

Part 1: A systematic review of the existing literature surrounding how developer behaviour contributes to the introduction of security defects, how developer behaviour can be measured, how security defects can be measured in code, particularly using SAST Part 2: An experiment that aims to investigate this relationship by proposing a pipeline & methodology by which both developer behaviour indicators, and security defects can be measured by analyzing code change patterns in existing software repositories.

Part 1: Literature Review

This literature review seeks to explore existing research on the relationship between developer behavior, best practices, and software security.

Key topics include:

  • the metrics used to measure developer behavior and adherence to best practices,
  • how security vulnerabilities are quantified in code, and
  • whether any established correlations exist between developer practices and the occurrence of security defects.

Literature Review Methodology

We adapted the PRISMA approach to conduct a systematic literature review, to provide a framework for a more reproducible and rigorous process [4]. PRISMA is a well-documented convention for reproducible and transparent systematic reviews in the medical science field, and has been applied here with the same intention.