Resilience engineering (RE) is most commonly applied at the organisational level, and has historically been associated with safety-critical industries such as nuclear, medical or aviation. This paper explores the application of RE frameworks within software engineering, and investigates resilient performance of the socio-technical system that supports the creation of software. We present a preliminary study based on a secondary analysis of data from previous ethnographic studies of commercial software practice. This analysis uses an RE framework devised for small team practice in safety critical settings. We present and discuss three salient episodes of software practice that illustrate the application of RE principles to software engineering, and suggest how this kind of analysis may benefit software engineering. We present challenges and opportunities based on our experience and propose future research directions.

The pressure on software developers to produce secure software has never been greater. But what does security look like in environments that do not produce security-critical software? In answer to this question, this multi-sited ethnographic study characterizes security episodes and identifies five typical behaviors in software development. Using theory drawn from information security and motivation research in software engineering, this article characterizes key ways in which individual developers form security responses to meet the demands of particular circumstances, providing a framework managers and teams can use to recognize, understand, and alter security activity in their environments.

Despite the availability of various methods and tools to facilitate secure coding, developers continue to write code that contains common vulnerabilities. It is important to understand why technological advances do not sufficiently facilitate developers in writing secure code. To widen our understanding of developers' behaviour, we considered the complexity of the security decision space of developers using theory from cognitive and social psychology. Our interdisciplinary study reported in this article (1) draws on the psychology literature to provide conceptual underpinnings for three categories of impediments to achieving security goals, (2) reports on an in-depth meta-analysis of existing software security literature that identified a catalogue of factors that influence developers' security decisions, and (3) characterises the landscape of existing security interventions that are available to the developer during coding and identifies gaps. Collectively, these show that different forms of impediments to achieving security goals arise from different contributing factors. Interventions will be more effective where they reflect psychological factors more sensitively and marry technical sophistication, psychological frameworks, and usability. Our analysis suggests “adaptive security interventions” as a solution that responds to the changing security needs of individual developers and a present a proof-of-concept tool to substantiate our suggestion.

Software rarely works as intended while it is being written. Things go wrong in the midst of everyday practice, and developers are commonly understood to form theories and strategies for dealing with them. Errors in this sense are not bugs left behind in software, they are actively encountered and experienced. This paper reports findings of an ethnographically-informed study undertaken to examine error encountered at the desk. Films depicting paired open-source development practice over the course of a month were analyzed to identify and delineate instances of active error. Instances were interpreted within a framework of error handling drawn from psychology research. Analyses of representative instances are given and discussed in relation to software engineering research that examines practice at the desk. Findings demonstrate that the significance of active error in software development is personal, shaped by passing time, the emergence of preferred practices and environmental changes.