How far are German companies in improving security through static program analysis tools?

2022 IEEE Secure Development Conference (SecDev) Pub Date : 2022-08-12 DOI:10.1109/SecDev53368.2022.00015

Goran Piskachev, Stefan Dziwok, Thorsten Koch, Sven Merschjohann, E. Bodden

{"title":"How far are German companies in improving security through static program analysis tools?","authors":"Goran Piskachev, Stefan Dziwok, Thorsten Koch, Sven Merschjohann, E. Bodden","doi":"10.1109/SecDev53368.2022.00015","DOIUrl":null,"url":null,"abstract":"As security becomes more relevant for many com-panies, the popularity of static program analysis (SPA) tools is increasing. In this paper, we target the use of SPA tools among companies in Germany with a focus on security. We give insights on the current issues and the developers' willingness to configure the tools to overcome these issues. Compared to previous studies, our study considers the companies' culture and processes for using SPA tools. We conducted an online survey with 256 responses and semi-structured interviews with 17 product owners and executives from multiple companies. Our results show a diversity in the usage of tools. Only half of our survey participants use SPA tools. The free tools tend to be more popular among software developers. In most companies, software developers are encouraged to use free tools, whereas commercial tools can be requested. However, the product owners and executives in our interviews reported that their developers do not request new tools. We also find out that automatic security checks with tools are rarely performed on each release.","PeriodicalId":407946,"journal":{"name":"2022 IEEE Secure Development Conference (SecDev)","volume":"24 1","pages":"0"},"PeriodicalIF":0.0000,"publicationDate":"2022-08-12","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"0","resultStr":null,"platform":"Semanticscholar","paperid":null,"PeriodicalName":"2022 IEEE Secure Development Conference (SecDev)","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.1109/SecDev53368.2022.00015","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"","JCRName":"","Score":null,"Total":0}

引用次数: 0

Abstract

As security becomes more relevant for many com-panies, the popularity of static program analysis (SPA) tools is increasing. In this paper, we target the use of SPA tools among companies in Germany with a focus on security. We give insights on the current issues and the developers' willingness to configure the tools to overcome these issues. Compared to previous studies, our study considers the companies' culture and processes for using SPA tools. We conducted an online survey with 256 responses and semi-structured interviews with 17 product owners and executives from multiple companies. Our results show a diversity in the usage of tools. Only half of our survey participants use SPA tools. The free tools tend to be more popular among software developers. In most companies, software developers are encouraged to use free tools, whereas commercial tools can be requested. However, the product owners and executives in our interviews reported that their developers do not request new tools. We also find out that automatic security checks with tools are rarely performed on each release.

查看原文本刊更多论文

德国公司在通过静态程序分析工具提高安全性方面取得了多大进展?

随着安全性与许多公司的关系越来越密切，静态程序分析(SPA)工具也越来越受欢迎。在本文中，我们的目标是在德国公司中使用SPA工具，重点关注安全性。我们提供了对当前问题的见解，以及开发人员配置工具以克服这些问题的意愿。与以前的研究相比，我们的研究考虑了公司的文化和使用SPA工具的过程。我们对来自多家公司的17位产品负责人和高管进行了一项有256个回复的在线调查和半结构化访谈。我们的结果显示了工具使用的多样性。只有一半的调查参与者使用SPA工具。免费工具在软件开发人员中更受欢迎。在大多数公司中，软件开发人员被鼓励使用免费工具，而商业工具可以被要求使用。然而，在我们的采访中，产品所有者和执行人员报告说，他们的开发人员并没有要求新的工具。我们还发现，使用工具的自动安全检查很少在每个版本上执行。

本文章由计算机程序翻译，如有差异，请以英文原文为准。

求助全文

约1分钟内获得全文求助全文

来源期刊

2022 IEEE Secure Development Conference (SecDev)

自引率

0.00%

发文量