A Socio-Technical Perspective on Software Vulnerabilities: A Causal Analysis
• Article
Publisher
Software Engineering Institute
DOI (Digital Object Identifier)
10.1016/j.infsof.2024.107553Topic or Tag
Abstract
Software development organizations are composed of networks of people working together towards a common goal. The effectiveness of these networks seems like it would be an essential consideration for the effectiveness of the organization as a whole, but does network effectiveness actually matter?
This article’s authors studied OpenSSL and about 100 of its published vulnerabilities. They performed a socio-technical analysis on OpenSSL and found that social smells could be causally linked to the effort to maintain files related to software vulnerabilities.
This result has significant implications for the management of software projects. These insights may motivate and help to guide project managers and architects to broaden their efforts to team communications, and not merely on technical quality measures, such as bug rates or feature velocity. Social interactions among a project team’s members matter, and smells can be measured and monitored.