Social engineering is the acquisition of informationabout computer systems by methods that deeply include non-technical means. While technical security of most critical systemsis high, the systems remain vulnerable to attacks from socialengineers. Social engineering is a technique that: (i) does notrequire any (advanced) technical tools, (ii) can be used by anyone,(iii) is cheap. Traditional security requirements elicitation approaches oftenfocus on vulnerabilities in network or software systems. Fewapproaches even consider the exploitation of humans via socialengineering and none of them elicits personal behaviours of indi-vidual employees. While the amount of social engineering attacksand the damage they cause rise every year, the security awarenessof these attacks and their consideration during requirementselicitation remains negligible. We propose to use a card game to elicit these requirements, which all employees of a company can play to understand thethreat and document security requirements. The game considersthe individual context of a company and presents underlyingprinciples of human behaviour that social engineers exploit, aswell as concrete attack patterns. We evaluated our approachwith several groups of researchers, IT administrators, andprofessionals from industry.

https://mediatum.ub.tum.de/doc/1328974/file.pdf

A Serious Game for Eliciting Social Engineering Security Requirements

Research has established the wide variety of security failures in mobile apps, their consequences, and how app developers introduce or exacerbate them. What is not well known is why developers do so-what is the rationale underpinning the decisions they make which eventually strengthen or weaken app security? This is all the more complicated in modern app development's increasingly diverse demographic: growing numbers of independent, solo, or small team developers who do not have the organizational structures and support that larger software development houses enjoy. Through two studies, we open the box on developer rationale, by performing a holistic analysis of the rationale underpinning various activities in which app developers engage when developing an app. The first study does so through a task-based study with app developers ( $\mathrm{N}=44$ ) incorporating six distinct tasks for which this developer demographic must take responsibility: setting up a development environment, reviewing code, seeking help, seeking testers, selecting an advertisement SDK, and software licensing. We found that, while on first glance in several activities participants seemed to prioritize security, only in the code task such prioritization was underpinned by a security rationale-indicating that development behavior perceived to be secure may only be an illusion until the box is opened on their rationale. The second study confirms these findings through a wider survey of app developers ( $\mathrm{N}=274$ ) investigating to what extent they find the activities of the task-based study to affect their app's security. In line with the task-based study, we found that developers perceived actively writing code and actively using external SDKs as the only security-relevant, while similarly disregarding other activities having an impact on app security. Our results suggest the need for a stronger focus on the tasks and activities surrounding the coding task - all of which need to be underpinned by a security rationale. Without such a holistic focus, developers may write “secure code” but not produce “secure apps”.

/pdf/schrodinger-s-security-opening-the-box-on-app-developers-4utwibfa9z.pdf

Schrödinger's security: opening the box on app developers' security rationale

Psychologists can now quantify behaviours beyond the laboratory using a mass-adopted, unified system that is primed for data capture a.k.a. smartphones. This is the first book to bring together related areas of smartphone research and point towards how psychology can benefit and engage with these developments in the future. It critically considers how smartphones and related digital devices help answer and generate new research questions for psychological science. The book then guides readers through how smartphones are being used within psychology and social science more broadly. Drawing from examples of both good and bad practice within current research, a new perspective is brought to major themes and debates across behavioural science. In the digital age, smartphones and associated devices will be able to accomplish much more in the near future. Psychology has a key role to play when it comes to balancing this monumental potential with carefully considered research.

Smartphones within Psychological Science

Given the impact of people motivation on software engineering, it is no surprise to see that gamification techniques have been studied and applied to the field. A relevant number of studies have been reported on the subject, and different understandings of the technique are around. However, it is not clear what gamification brings to industrial software development settings. This paper intends to map the state of the art on the use and understanding of gamification in industrial software development. We aim to review the definitions of gamification adopted in software engineering studies, identify the elements of games that are used to motivate software engineers, and map the specific areas of software engineering that have been addressed so far. For that end, we conducted a mixed method literature review, covering 130 studies. From such review, we found that (1) researchers in the field tend towards a strict view of gamification, (2) the practical results of gamification are unclear and polemic, and (3) this research area has still much to improve.

Gamification in Software Engineering: A literature Review

Social Interaction and Interpersonal Relationships

While developing and deploying software continue to be more broadly accessible, so is the problem caused by these systems' security not being considered enough by their developers and maintainers. We propose to address this developer-centred security issue with serious games (games for which entertainment is not the main purpose) as a means to motivate developers to consider security threats when developing. We have developed a serious game around secure and non-secure programming exercises to investigate if serious gamification helps to improve attitudes or ability with secure programming. We detail the design choices of the game and how it relates to the programming tasks. In particular we present the design choices we made with the intention to replicate a prior study and discuss the tension that arose between replication and intervention. We discuss the results of a pilot study we conducted and present the steps we plan to take going forward into larger studies.

/pdf/how-could-serious-games-support-secure-programming-designing-34to73ijlb.pdf

How Could Serious Games Support Secure Programming? Designing a Study Replication and Intervention

The cyber security context requires to better understand how developers write (in)secure code and to assist them in their software developments. We have developed a secure coding experiment and serious game intervention. In this paper, we report on the design of a serious game to investigate developer-centred security. We used a combination of approaches to shape discussions and support the serious game co-creation.

/pdf/co-created-design-of-a-serious-game-investigation-into-37iqh06jg4.pdf

Co-created Design of a Serious Game Investigation into Developer-Centred Security

Offering timely feedback on programming while encouraging learners to engage in critical evaluation of programs are the objectives of peer-testing. We report on a peer-testing experiment with students on distant campuses using a Web platform. The experiment shows the potential that peer-testing has to help students transition from passive learners to critical evaluators.  Keywords: Computer science education, peer testing, peer feedback, software testing, student transitions

/pdf/transition-from-passive-learner-to-critical-evaluator-3lqpfyddpt.pdf

Transition from Passive Learner to Critical Evaluator through Peer-Testing of Programming Artefacts

My research involves investigating gamification and serious games in relation to secure programming. Current research has shown the effectiveness of serious games in other contexts, and I aim to discover what kinds of game or gameplay work most effectively and develop a more reusable system for designing serious games or gamifications for programming contexts.

Gamification and Collaboration to Evaluate and Improve the Security Mindset of Developers

As part of formative and summative assessments in programming courses, students work on developing programming artifacts following a given specification. These artifacts are evaluated by the teachers. At the end of this evaluation, the students receive feedback and marks. Providing feedback on programming artifacts is time demanding and could make feedback to arrive too late for it to be effective for the students' learning. We propose to combine software testing with peer feedback which has been praised for offering a timely and effective learning activity with program testing. 
In this paper we report on the development of a Web platform for peer feedback on programming artifacts through program testing. We discuss the development process of our peer-testing platform informed by teachers and students.

Léon McGregor

Papers

How Could Serious Games Support Secure Programming? Designing a Study Replication and Intervention

Co-created Design of a Serious Game Investigation into Developer-Centred Security

Transition from Passive Learner to Critical Evaluator through Peer-Testing of Programming Artefacts

Gamification and Collaboration to Evaluate and Improve the Security Mindset of Developers

Development of a Web Platform for Code Peer-Testing