research-article

An empirical study of security culture in open source software communities

Authors:

Mazaher Kianpour,

Stewart KowalskiAuthors Info & Claims

ASONAM '19: Proceedings of the 2019 IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining

Pages 863 - 870

https://doi.org/10.1145/3341161.3343520

Published: 15 January 2020 Publication History

Abstract

Open source software (OSS) is a core part of virtually all software applications today. Due to the rapidly growing impact of OSS on society and the economy, the security aspect has attracted researchers' attention to investigate this distinctive phenomenon. Traditionally, research on OSS security has often focused on technical aspects of software development. We argue that these aspects are important, however, technical security practice considering different social aspects of OSS development will assure the effectiveness and efficiency of the implementation of the tool. To mitigate this research gap, in this empirical study, we explore the current security culture in the OSS development phenomenon using a survey instrument with six evaluation dimensions: attitude, behavior, competency, subjective norms, governance, and communication. By exploring the current security culture in OSS communities, we can start to understand the influence of security on participants' security behaviors and decision-making, so that we can make realistic and practical suggestions. In this paper, we present the measurements of security culture adopted in the study and discuss corresponding security issues that need to be addressed in OSS communities.

References

[1]

Humes, L.L. (2007), "Communities of Practice for Open Source Software", in Handbook of Research on Open Source Software: Technological, Economic, and Social Perspectives, IGI Global. pages 610--623.

[2]

Godfrey, M.W. and Q. Tu (2000), "Evolution in open source software: A case study". in Software Maintenance, 2000. Proceedings. International Conference on. IEEE.

[3]

Scacchi, W., et al. (2006), "Understanding free/open source software development processes". Software Process: Improvement and Practice, volume 11, issue 2, pages 95--105.

[4]

Feller, J. and B. Fitzgerald (2002), "Understanding open source software development". volume: Addison-Wesley London.

[5]

Feller, J., et al. (2006), "Developing open source software: a community-based analysis of research", in Social Inclusion: Societal and Organizational Implications for Information Systems, Springer. pages 261--278.

[6]

NorthBridge, B., "2016 Future of Open Source Survey", Electronic document. http://www.northbridge.com/2016-future-open-source-survey-results. (Accessed on 3-29-2019)

[7]

BlackDuck Software, "2017 Open Source Security and Risk Analysis", Web: https://www.blackducksoftware.com/open-source-security-risk-analysis-2017. (Accessed on 3-29-2019)

[8]

Wen, S.-F. (2017), "Software Security in Open Source Development: A Systematic Literature Review". in Proceedings of the 21st Conference of Open Innovations Association FRUCT. Helsinki, Finland.

Digital Library

[9]

snyk, "The state of open source security - 2019"; Available from: https://snyk.io/opensourcesecurity-2019/. (Accessed on 3-29-2019)

[10]

Scacchi, W. (2002), "Understanding the requirements for developing open source software systems". in IEE Proceedings-Software. IET.

[11]

Fox, W.M. (1995), "Sociotechnical system principles and guidelines: past and present". The Journal of Applied Behavioral Science, volume 31, issue 1, pages 91--105.

[12]

Zeitlyn, D.J.R.p. (2003), "Gift economies in the development of open source software: anthropological reflections". volume 32, issue 7, pages 1287--1291.

[13]

Schlienger, T. and S. Teufel (2003), "Analyzing information security culture: increased trust by an appropriate information security culture". in 14th International Workshop on Database and Expert Systems Applications, 2003. Proceedings.: IEEE.

[14]

Schlienger, T. and S. Teufel (2002), "Information security culture", in Security in the Information Society, Springer. pages 191--201.

[15]

Chen, C.C., et al. (2008), "A cross-cultural investigation of situational information security awareness programs". volume 16, issue 4, pages 360--376.

[16]

Ouchi, W.G.J.A.s.q. (1980), "Markets, bureaucracies, and clans". volume, issue, pages 129--141.

[17]

Von Krogh, G., et al. (2012), "Carrots and rainbows: Motivation and social practice in open source software development". MIS quarterly, volume 36, issue 2, pages 649--676.

[18]

Ouchi, W.G. (1979), "A conceptual framework for the design of organizational control mechanisms", in Readings in accounting for management control, Springer. pages 63--82.

[19]

Kirsch, L.J.J.O.S. (1996), "The management of complex tasks in organizations: Controlling the systems development process". volume 7, issue 1, pages 1--21.

[20]

Ducheneaut, N. (2005), "Socialization in an open source software community: A socio-technical analysis". Computer Supported Cooperative Work (CSCW), volume 14, issue 4, pages 323--368.

Digital Library

[21]

Madey, G., V. Freeh, and R. Tynan (2002), "The open source software development phenomenon: An analysis based on social network theory". AMCIS 2002 Proceedings, volume, issue, pages 247.

[22]

Gasser, L., et al. (2003), "Understanding continuous design in F/OSS projects". in In 16th. Intern. Conf. Software & Systems Engineering and their Applications. Citeseer.

[23]

Cusumano, M.A. and R.W. Selby (1998), "Microsoft secrets: how the world's most powerful software company creates technology, shapes markets, and manages people". volume: Simon and Schuster.

[24]

Olchi, W.G.J.A.o.M.J. (1978), "The transmission of control through organizational hierarchy". volume 21, issue 2, pages 173--192.

[25]

Sharma, S., V. Sugumaran, and B.J.I.S.J. Rajagopalan (2002), "A framework for creating hybrid-open source software communities". volume 12, issue 1, pages 7--25.

[26]

Schmidt, D.C. and A. Porter (2001), "Leveraging open-source communities to improve the quality & performance of open-source software". in Proceedings of the 1st Workshop on Open Source Software Engineering. Citeseer.

[27]

Nelson, M., R. Sen, and C. Subramaniam (2006), "Understanding open source software: A research classification framework". Communications of the Association for Information Systems, volume 17, issue 1, pages 12.

[28]

Vadalasetty, S.R.J.S.I. (2003), "Security concerns in using open source software for enterprise requirements". volume, issue, pages.

[29]

Ye, Y. and K. Kishida (2003), "Toward an understanding of the motivation Open Source Software developers". in Proceedings of the 25th international conference on software engineering. IEEE Computer Society.

Digital Library

[30]

Von KROGh, G. and S. Spaeth (2007), "The open source software phenomenon: Characteristics that promote research". The Journal of Strategic Information Systems, volume 16, issue 3, pages 236--253.

[31]

Grodzinsky, F.S., et al. (2003), "Ethical issues in open source software". volume 1, issue 4, pages 193--205.

[32]

Von Krogh, G. and E. Von Hippel (2003), "Special issue on open source software development", Elsevier.

[33]

Yamauchi, Y., et al. (2000), "Collaboration with Lean Media: how open-source software succeeds". in Proceedings of the 2000 ACM conference on Computer supported cooperative work. ACM.

Digital Library

[34]

Dhillon, G. (1997), "Managing information system security". volume: Macmillan International Higher Education.

[35]

Martins, A. and J. Elofe (2002), "Information security culture", in Security in the information society, Springer. pages 203--214.

[36]

Ngo, L., W. Zhou, and M. Warren (2005), "Understanding Transition towards Information Security Culture Change". in AISM.

[37]

Al Sabbagh, B. and S. Kowalski (2012), "Developing social metrics for security modeling the security culture of it workers individuals (case study)". in Communications, Computers and Applications (MIC-CCA), 2012 Mosharaka International Conference on. IEEE.

[38]

Da Veiga, A. and J.H. Eloff (2010), "A framework and assessment instrument for information security culture". Computers & Security, volume 29, issue 2, pages 196--207.

Digital Library

[39]

Ramachandran, S., S.V. Rao, and T. Goles (2008), "Information security cultures of four professions: a comparative study". in Hawaii International Conference on System Sciences, Proceedings of the 41st Annual. IEEE.

Digital Library

[40]

Van Niekerk, J. and R. Von Solms (2005), "A holistic framework for the fostering of an information security sub-culture in organizations". in Issa.

[41]

Martins, N., A. Da Veiga, and J.H.J.S.A.B.R. Eloff (2007), "Information security culture-validation of an assessment instrument". volume 11, issue 1, pages 147--166.

[42]

Furnell, S.J.C. and Security (2007), "From the Editor-in-Chief: IFIP workshop-Information security culture". volume 26, issue 1, pages 35.

[43]

Bulgurcu, B., H. Cavusoglu, and I.J.M.q. Benbasat (2010), "Information security policy compliance: an empirical study of rationality-based beliefs and information security awareness". volume 34, issue 3, pages 523--548.

[44]

Woon, I.M. and A.J.I.J.o.H.-C.S. Kankanhalli (2007), "Investigation of IS professionals' intention to practise secure development of applications". volume 65, issue 1, pages 29--41.

[45]

Ajzen, I., M.J.J.o.p. Fishbein, and S. Psychology (1973), "Attitudinal and normative variables as predictors of specific behavior". volume 27, issue 1, pages 41.

[46]

Chia, P., S. Maynard, and A.J.P.o.P.J. Ruighaver (2002), "Understanding organizational security culture". volume 158.

[47]

Kruger, H.A., W.D.J.c. Kearney, and security (2008), "Consensus ranking-An ICT security awareness case study". volume 27, issue 7-8, pages 254--259.

[48]

Cox, A., S. Connolly, and J.J.V. Currall (2001), "Raising information security awareness in the academic setting". volume 31, issue 2, pages 11--16.

[49]

Harnesk, D., J.J.I.M. Lindström, and C. Security (2011), "Shaping security behaviour through discipline and agility: Implications for information security management". volume 19, issue 4, pages 262--276.

[50]

Dhillon, G. (2001), "Challenges in managing information security in the new millennium", in Information security management: Global challenges in the new millennium, IGI Global. pages 1--8.

[51]

Bakanauskienė, I. and J. Martinkienė (2011), "Determining managerial competencies of management professionals". Management of Organizations: Systematic Research volume, issue 60, pages 29--43.

[52]

Campion, M.A., et al. (2011), "Doing competencies well: Best practices in competency modeling". volume 64, issue 1, pages 225--262.

[53]

Koeppen, K., et al. (2008), "Current issues in competence modeling and assessment". volume 216, issue 2, pages 61--73.

[54]

Farrior, M.J.B.P.F. (2005), "Breakthrough strategies for engaging the public: Emerging trends in communications and social science".

[55]

Singh, M.P.J.A.T.o.I.S. and Technology (2013), "Norms as a basis for governing sociotechnical systems". volume 5, issue 1, pages 21.

[56]

Avery, D., et al. (2016), "Externalization of software behavior by the mining of norms". in Proceedings of the 13th International Conference on Mining Software Repositories. ACM.

Digital Library

[57]

Venkatesh, V. and S.A.J.M.q. Brown (2001), "A longitudinal investigation of personal computers in homes: adoption determinants and emerging challenges". pages 71--102.

[58]

Sheeran, P. and S.J.J.o.A.S.P. Orbell (1999), "Augmenting the theory of planned behavior: roles for anticipated regret and descriptive norms 1". volume 29, issue 10, pages 2107--2142.

[59]

Koh, K., et al. (2005), "Security Governance: Its Impact on Security Culture". in AISM.

[60]

Dallas, S. and M.J.G.I. Bell (2004), "The need for IT governance: Now more than ever".

[61]

Weill, P. and R. Woodham (2002), "Don't just lead, govern: Implementing effective IT governance".

[62]

Sholler, D., "Community Call - Governance strategies for open source research software projects"; Available from: https://www.rbloggers.com/community-call-governance-strategies-for-open-source-research-software-projects/. (Accessed on 3-29-2019)

[63]

Koskosas, I. (2011), "Web Banking: A Security Management and Communications Approach". International Journal of Computer Science & Engineering Technology volume 2, issue 7, pages 146--154.

[64]

DeVito, J.A. (2002), "Human communication", Boston: Allyn & Bacon. pages.

[65]

Anne, A. and M.A.J.C.A. Sasse (1999), "Users are not the enemy". volume 42, issue 12, pages 40--46.

[66]

Boh, W.F. (2007), "Mechanisms for sharing knowledge in project-based organizations". Information and organization, volume 17, issue 1, pages 27--58.

[67]

Schlienger, T. and S. Teufel (2005), "Tool supported management of information security culture". in IFIP International Information Security Conference. Springer.

[68]

Siponen, M., et al. (2014), "Employees' adherence to information security policies: An exploratory field study". volume 51, issue 2, pages 217--224.

[69]

Berry, L.M. and J.P. Houston (1993), "Psychology at work: An introduction to industrial and organizational psychology". volume: Brown & Benchmark/Wm. C. Brown Publ.

[70]

GitHub, "Github user search"; Available from: https://github.com/search?q=type:user&type=Users. (Accessed on 3-29-2019)

[71]

GitHub, "Celebrating nine years of GitHub with an anniversary sale"; Available from: https://github.com/blog/2345-celebrating-nine-years-of-github-with-an-anniversary-sale. (Accessed on 3-29-2019)

[72]

Wen, S.-F. (2018), "Learning secure programming in open source software communities: a socio-technical view". in Proceedings of the 6th International Conference on Information and Education Technology. ACM.

Digital Library

[73]

Khan, B., et al. (2011), "Effectiveness of information security awareness methods based on psychological theories". volume 5, issue 26, pages 10862--10868.

[74]

Shaw, R.S., et al. (2009), "The impact of information richness on information security awareness training effectiveness". volume 52, issue 1, pages 92--100.

[75]

Merhi, M.I. and V. Midha (2012), "The impact of training and social norms on information security compliance: A pilot study".

[76]

Siponen, M.T.J.I.M. and C. Security (2000), "A conceptual foundation for organizational information security awareness". volume 8, issue 1, pages 31--41.

[77]

Benbya, H. and N. Belbaly (2010), "Understanding developers' motives in open source projects: a multi-theoretical framework".

[78]

Ryan, R.M. and E.L.J.A.p. Deci (2000), "Self-determination theory and the facilitation of intrinsic motivation, social development, and well-being". volume 55, issue 1, pages 68.

Cited By

Gruner BHeckner SSonnekalb TBouhlal BBrust C(2024)Finding a Needle in a Haystack: Threat Analysis in Open-Source Projects2024 IEEE International Conference on Software Analysis, Evolution and Reengineering - Companion (SANER-C)10.1109/SANER-C62648.2024.00024(141-145)Online publication date: 12-Mar-2024
https://doi.org/10.1109/SANER-C62648.2024.00024
Valdés-Rodríguez YHochstetter-Diez JDiéguez-Rebolledo MBustamante-Mora ACadena-Martínez R(2024)Analysis of Strategies for the Integration of Security Practices in Agile Software Development: A Sustainable SME ApproachIEEE Access10.1109/ACCESS.2024.337238512(35204-35230)Online publication date: 2024
https://doi.org/10.1109/ACCESS.2024.3372385
Mitcheltree CMugurusi GHoltskog H(2023)Cyber Security Culture as a Resilience-Promoting Factor for Human-Centered Machine Learning and Zero-Defect Manufacturing EnvironmentsFlexible Automation and Intelligent Manufacturing: Establishing Bridges for More Sustainable Manufacturing Systems10.1007/978-3-031-38165-2_86(741-752)Online publication date: 25-Aug-2023
https://doi.org/10.1007/978-3-031-38165-2_86
Show More Cited By

Recommendations

Learning secure programming in open source software communities: a socio-technical view
ICIET '18: Proceedings of the 6th International Conference on Information and Education Technology

In open source software (OSS) communities, volunteers collaborate and integrate expertise to develop the software online via the Internet in a decentralized, highly interactive and knowledge-intensive process. Development of qualified and secured ...
Open source vs. closed source software: towards measuring security
SAC '09: Proceedings of the 2009 ACM symposium on Applied Computing

The increasing availability and deployment of open source software in personal and commercial environments makes open source software highly appealing for hackers, and others who are interested in exploiting software vulnerabilities. This deployment has ...
Sustainability of Open Source software communities beyond a fork

First comprehensive analysis of Open Source projects involving a fork.The LibreOffice project, which was forked from the OpenOffice.org project, shows no sign of long-term decline.LibreOffice has attracted the long-term and most active committers in ...

Comments

Please enable JavaScript to view thecomments powered by Disqus.

Information & Contributors

Information

Published In

cover image ACM Conferences

ASONAM '19: Proceedings of the 2019 IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining

August 2019

1228 pages

ISBN:9781450368681

DOI:10.1145/3341161

Editors:
Francesca Spezzano
Boise State University
,
Wei Chen
Microsoft Research, China
,
Xiaokui Xiao
National University of Singapore, Singapore

Copyright © 2019 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected].

Sponsors

SIGKDD: ACM Special Interest Group on Knowledge Discovery in Data

In-Cooperation

IEEE CS

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 15 January 2020

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article

Conference

ASONAM '19

Sponsor:

SIGKDD

ASONAM '19: International Conference on Advances in Social Networks Analysis and Mining

August 27 - 30, 2019

British Columbia, Vancouver, Canada

Acceptance Rates

ASONAM '19 Paper Acceptance Rate 41 of 286 submissions, 14%;

Overall Acceptance Rate 116 of 549 submissions, 21%

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

4
Total Citations
View Citations
320
Total Downloads

Downloads (Last 12 months)74
Downloads (Last 6 weeks)9

Reflects downloads up to 17 Nov 2024

Other Metrics

View Author Metrics

Citations

Cited By

Gruner BHeckner SSonnekalb TBouhlal BBrust C(2024)Finding a Needle in a Haystack: Threat Analysis in Open-Source Projects2024 IEEE International Conference on Software Analysis, Evolution and Reengineering - Companion (SANER-C)10.1109/SANER-C62648.2024.00024(141-145)Online publication date: 12-Mar-2024
https://doi.org/10.1109/SANER-C62648.2024.00024
Valdés-Rodríguez YHochstetter-Diez JDiéguez-Rebolledo MBustamante-Mora ACadena-Martínez R(2024)Analysis of Strategies for the Integration of Security Practices in Agile Software Development: A Sustainable SME ApproachIEEE Access10.1109/ACCESS.2024.337238512(35204-35230)Online publication date: 2024
https://doi.org/10.1109/ACCESS.2024.3372385
Mitcheltree CMugurusi GHoltskog H(2023)Cyber Security Culture as a Resilience-Promoting Factor for Human-Centered Machine Learning and Zero-Defect Manufacturing EnvironmentsFlexible Automation and Intelligent Manufacturing: Establishing Bridges for More Sustainable Manufacturing Systems10.1007/978-3-031-38165-2_86(741-752)Online publication date: 25-Aug-2023
https://doi.org/10.1007/978-3-031-38165-2_86
Wang PGuemundsson BKotowicz K(2021)Adopting Trusted Types in ProductionWeb Frameworks to Prevent DOM-Based Cross-Site Scripting: A Case Study2021 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)10.1109/EuroSPW54576.2021.00013(60-73)Online publication date: Sep-2021
https://doi.org/10.1109/EuroSPW54576.2021.00013
Ashenden DOllis G(2020)Putting the Sec in DevSecOps: Using Social Practice Theory to Improve Secure Software DevelopmentProceedings of the New Security Paradigms Workshop 202010.1145/3442167.3442178(34-44)Online publication date: 26-Oct-2020
https://dl.acm.org/doi/10.1145/3442167.3442178

View Options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Media

Figures

Other

Tables

View Table of Contents