A Qualitative Study of Dependency Management and Its Security Implications

I. Pashchenko; D.-L. Vu; F. Massacci

doi:10.1145/3372297.3417232

A Qualitative Study of Dependency Management and Its Security Implications

I. Pashchenko
, D.-L. Vu
, F. Massacci

Research output: Chapter in Book / Report / Conference proceeding › Conference contribution › Academic › peer-review

Abstract

Several large scale studies on the Maven, NPM, and Android ecosystems point out that many developers do not often update their vulnerable software libraries thus exposing the user of their code to security risks. The purpose of this study is to qualitatively investigate the choices and the interplay of functional and security concerns on the developers' overall decision-making strategies for selecting, managing, and updating software dependencies.

We run 25 semi-structured interviews with developers of both large and small-medium enterprises located in nine countries. All interviews were transcribed, coded, and analyzed according to applied thematic analysis. They highlight the trade-offs that developers are facing and that security researchers must understand to provide effective support to mitigate vulnerabilities (for example bundling security fixes with functional changes might hinder adoption due to lack of resources to fix functional breaking changes).

We further distill our observations to actionable implications on what algorithms and automated tools should achieve to effectively support (semi-)automatic dependency management.

Original language	English
Title of host publication	CCS '20: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security
Publisher	Association for Computing Machinery
Pages	1513–1531
ISBN (Electronic)	9781450370899
ISBN (Print)	9781450370899
DOIs	https://doi.org/10.1145/3372297.3417232 https://doi.org/10.1145/3372297.3417232
Publication status	Published - 30 Oct 2020
Externally published	Yes
Event	27th ACM SIGSAC Conference on Computer and Communications Security, CCS 2020 - Virtual, Online, United States Duration: 9 Nov 2020 → 13 Nov 2020

Publication series

Name	Proceedings of the ACM Conference on Computer and Communications Security
ISSN (Print)	1543-7221

Conference

Conference	27th ACM SIGSAC Conference on Computer and Communications Security, CCS 2020
Country/Territory	United States
City	Virtual, Online
Period	9/11/20 → 13/11/20

Funding

Funders	Funder number
European Network for Cyber Security	675320
Horizon 2020 Framework Programme
European Commission	830929

VU Research Profile

Connected World
Governance for Society

Access to Document

10.1145/3372297.3417232Licence: Unspecified
10.1145/3372297.3417232

Persistent URL (handle)

Persistent link

Cite this

Pashchenko, I., Vu, D.-L., & Massacci, F. (2020). A Qualitative Study of Dependency Management and Its Security Implications. In CCS '20: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security (pp. 1513–1531). (Proceedings of the ACM Conference on Computer and Communications Security). Association for Computing Machinery. https://doi.org/10.1145/3372297.3417232, https://doi.org/10.1145/3372297.3417232

@inproceedings{f855d84d3b30407f968035d6a835aa1e,

title = "A Qualitative Study of Dependency Management and Its Security Implications",

abstract = "Several large scale studies on the Maven, NPM, and Android ecosystems point out that many developers do not often update their vulnerable software libraries thus exposing the user of their code to security risks. The purpose of this study is to qualitatively investigate the choices and the interplay of functional and security concerns on the developers' overall decision-making strategies for selecting, managing, and updating software dependencies. We run 25 semi-structured interviews with developers of both large and small-medium enterprises located in nine countries. All interviews were transcribed, coded, and analyzed according to applied thematic analysis. They highlight the trade-offs that developers are facing and that security researchers must understand to provide effective support to mitigate vulnerabilities (for example bundling security fixes with functional changes might hinder adoption due to lack of resources to fix functional breaking changes). We further distill our observations to actionable implications on what algorithms and automated tools should achieve to effectively support (semi-)automatic dependency management.",

author = "I. Pashchenko and D.-L. Vu and F. Massacci",

year = "2020",

month = oct,

day = "30",

doi = "10.1145/3372297.3417232",

language = "English",

isbn = "9781450370899",

series = "Proceedings of the ACM Conference on Computer and Communications Security",

publisher = "Association for Computing Machinery",

pages = "1513–1531",

booktitle = "CCS '20: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security",

note = "27th ACM SIGSAC Conference on Computer and Communications Security, CCS 2020 ; Conference date: 09-11-2020 Through 13-11-2020",

}

Pashchenko, I, Vu, D-L & Massacci, F 2020, A Qualitative Study of Dependency Management and Its Security Implications. in CCS '20: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security. Proceedings of the ACM Conference on Computer and Communications Security, Association for Computing Machinery, pp. 1513–1531, 27th ACM SIGSAC Conference on Computer and Communications Security, CCS 2020, Virtual, Online, United States, 9/11/20. https://doi.org/10.1145/3372297.3417232, https://doi.org/10.1145/3372297.3417232

A Qualitative Study of Dependency Management and Its Security Implications. / Pashchenko, I.; Vu, D.-L.; Massacci, F.
CCS '20: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security. Association for Computing Machinery, 2020. p. 1513–1531 (Proceedings of the ACM Conference on Computer and Communications Security).

Research output: Chapter in Book / Report / Conference proceeding › Conference contribution › Academic › peer-review

TY - GEN

T1 - A Qualitative Study of Dependency Management and Its Security Implications

AU - Pashchenko, I.

AU - Vu, D.-L.

AU - Massacci, F.

PY - 2020/10/30

Y1 - 2020/10/30

N2 - Several large scale studies on the Maven, NPM, and Android ecosystems point out that many developers do not often update their vulnerable software libraries thus exposing the user of their code to security risks. The purpose of this study is to qualitatively investigate the choices and the interplay of functional and security concerns on the developers' overall decision-making strategies for selecting, managing, and updating software dependencies. We run 25 semi-structured interviews with developers of both large and small-medium enterprises located in nine countries. All interviews were transcribed, coded, and analyzed according to applied thematic analysis. They highlight the trade-offs that developers are facing and that security researchers must understand to provide effective support to mitigate vulnerabilities (for example bundling security fixes with functional changes might hinder adoption due to lack of resources to fix functional breaking changes). We further distill our observations to actionable implications on what algorithms and automated tools should achieve to effectively support (semi-)automatic dependency management.

AB - Several large scale studies on the Maven, NPM, and Android ecosystems point out that many developers do not often update their vulnerable software libraries thus exposing the user of their code to security risks. The purpose of this study is to qualitatively investigate the choices and the interplay of functional and security concerns on the developers' overall decision-making strategies for selecting, managing, and updating software dependencies. We run 25 semi-structured interviews with developers of both large and small-medium enterprises located in nine countries. All interviews were transcribed, coded, and analyzed according to applied thematic analysis. They highlight the trade-offs that developers are facing and that security researchers must understand to provide effective support to mitigate vulnerabilities (for example bundling security fixes with functional changes might hinder adoption due to lack of resources to fix functional breaking changes). We further distill our observations to actionable implications on what algorithms and automated tools should achieve to effectively support (semi-)automatic dependency management.

UR - https://www.scopus.com/pages/publications/85096186362

U2 - 10.1145/3372297.3417232

DO - 10.1145/3372297.3417232

M3 - Conference contribution

SN - 9781450370899

T3 - Proceedings of the ACM Conference on Computer and Communications Security

SP - 1513

EP - 1531

BT - CCS '20: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security

PB - Association for Computing Machinery

T2 - 27th ACM SIGSAC Conference on Computer and Communications Security, CCS 2020

Y2 - 9 November 2020 through 13 November 2020

ER -

Pashchenko I, Vu DL, Massacci F. A Qualitative Study of Dependency Management and Its Security Implications. In CCS '20: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security. Association for Computing Machinery. 2020. p. 1513–1531. (Proceedings of the ACM Conference on Computer and Communications Security). doi: 10.1145/3372297.3417232, 10.1145/3372297.3417232

A Qualitative Study of Dependency Management and Its Security Implications

Abstract

Publication series

Conference

Funding

VU Research Profile

Access to Document

Persistent URL (handle)

Other files and links

Fingerprint

Cite this