icon-carat-right menu search cmu-wordmark

A Socio-Technical Perspective on Software Vulnerabilities: A Causal Analysis

Article
This article investigates the causal relationships between the social behaviors of people developing software and effectively maintaining files related to software vulnerabilities.
Publisher

Software Engineering Institute

DOI (Digital Object Identifier)
10.1016/j.infsof.2024.107553

Abstract

Software development organizations are composed of networks of people working together towards a common goal. The effectiveness of these networks seems like it would be an essential consideration for the effectiveness of the organization as a whole, but does network effectiveness actually matter?

This article’s authors studied OpenSSL and about 100 of its published vulnerabilities. They performed a socio-technical analysis on OpenSSL and found that social smells could be causally linked to the effort to maintain files related to software vulnerabilities.

This result has significant implications for the management of software projects. These insights may motivate and help to guide project managers and architects to broaden their efforts to team communications, and not merely on technical quality measures, such as bug rates or feature velocity. Social interactions among a project team’s members matter, and smells can be measured and monitored.