Analyzing the Security Culture of Research Software Engineers
Creators: name: Armstrong, Matthew
name: Carver, Jeffrey
name: Milewicz, Reed
Publisher: name: Zenodo
Year: 2024
Subjects: Research Software
Security Culture
Research Software Engineers

description: Research software is critical for scientific advancement and, like all software, is susceptible to being targeted by malicious actors and misuse alike, meaning that security is an important quality of research software. Implementing and evaluating security is a complex and ever-evolving process. However, poor research software security could result in the sabotage of data, hardware, or research findings. Proper security implementation requires security knowledge and expertise that many research software stakeholders do not have, resulting in more burden placed on the limited bandwidth of security resources and personnel. Therefore, it is important to identify methods of improving methods of research software security without increasing demand for limited security resources.

To improve the security of research software, we propose introducing security concepts, such as threat modeling, to RSEs so they can be involved in ongoing security efforts. At its root, threat modeling is the process of creating a model of a system or piece of software that is used to theorize both potential attacks and countermeasures to prevent them. Threat modeling is a low-cost, effective way to supplement security efforts, improve security posture, and create cleaner software architecture. While difficult to automate, threat modeling has a host of tools available to make it easier to perform with less required security expertise compared to other security activities. RSEs are prime candidates for threat modeling because of their expertise in both the research domain and in software engineering.

To establish a baseline for how RSEs view security, we replicated a security culture survey originally focused on open-source software. This survey contains questions along six dimensions: Attitude, Behavior, Competency, Governance, Subjective Norms, and Communication. In aggregate, these six dimensions describe the security culture of the RSE community. In addition to measuring the current security culture, we exposed participants to three vignettes depicting security events. In the summary of these vignettes, we explained how threat modeling could have been used to prevent or diagnose malicious or accidental damages before they occurred.

We recruited 96 US and German RSEs for the survey. Our initial results show a generally positive security culture in the RSE community. Respondents perceived all cultural dimensions positively, except for Governance, which represents security expertise, policies, and implementation. The respondents also responded positively to threat modeling. They saw the value of threat modeling and thought it would fit nicely into their existing development processes. Respondents also indicated they would need additional training to effectively threat model and were interested in receiving this training.

We are using the data from the survey and vignettes to create resources that educate RSEs on threat modeling practices that can be incorporated into their existing development processes. We will use this talk to 1) present our findings to the US-RSE community, 2) gather feedback on the security resources we are developing for RSEs, and 3) promote dialogue about involving RSEs in security efforts.