论文标题
在开发环境中立即提供有关安全相关代码的反馈
Towards Immediate Feedback for Security Relevant Code in Development Environments
论文作者
论文摘要
如今，正确使用密码图库对于确保不同类型的应用程序的必要信息安全至关重要。软件开发中的一种常见实践是使用静态应用程序安全测试（SAST）工具来分析有关安全漏洞的代码。这些工具中的大多数旨在与开发环境分开运行。他们的结果是广泛的安全通知列表，哪些软件开发人员必须在耗时的后续步骤中手动检查。为了支持开发人员制定安全代码的任务，我们提出了一种方法，可以为他们提供集成开发环境（IDE）中SAST工具的持续反馈。我们的方法还考虑了安全通知的可理解性，并旨在采用以用户为中心的方法，该方法利用开发人员的反馈来构建针对每个开发人员量身定制的自适应系统。
Nowadays, the correct use of cryptography libraries is essential to ensure the necessary information security in different kinds of applications. A common practice in software development is the use of static application security testing (SAST) tools to analyze code regarding security vulnerabilities. Most of these tools are designed to run separately from development environments. Their results are extensive lists of security notifications, which software developers have to inspect manually in a time-consuming follow-up step. To support developers in their tasks of developing secure code, we present an approach for providing them with continuous immediate feedback of SAST tools in integrated development environments (IDEs). Our approach also considers the understandability of security notifications and aims for a user-centered approach that leverages developers' feedback to build an adaptive system tailored to each individual developer.
