Vulnerabilities persist despite existing software security initiatives and best practices. This paper focuses on the human factors of software security, including human behaviour and motivation. We conducted an online survey to explore the interplay between developers and software security processes, e.g., we looked into how developers influence and are influenced by these processes. Our data included responses from 123 software developers currently employed in North America who work on various types of software applications. Whereas developers are often held responsible for security vulnerabilities, our analysis shows that the real issues frequently stem from a lack of organizational or process support to handle security throughout development tasks. Our participants are self-motivated towards software security, and the majority did not dismiss it but identified obstacles to achieving secure code. Our work highlights the need to look beyond the individual, and take a holistic approach to investigate organizational issues influencing software security.

We conducted an online survey with 366 participants from Canada, India, the UK, and the US to compare privacy concerns and opinions about the collection of personal data by law enforcement and government agencies. We investigated what data participants were willing to share, in what circumstances participants were willing to allow data collection, what procedures companies should follow when they receive requests for customer information, and participants' general concern about their privacy. Statistical analysis showed that nationality and gender had significant impacts on participants' trust and perceptions of their governments, while nationality also impacted participants' willingness to share data under various circumstances. While participants were, on the whole, moderately amendable to data collection by government agencies given a court-ordered warrant, they also indicated a strong desire for increased transparency, and reported a lacklustre knowledge about privacy legislation.

Code analysis tools are not widely accepted by developers, and software vulnerabilities are detected by the thousands every year. We take a user-centered approach to that problem, starting with analyzing one of the popular open source static code analyzers, and uncover serious usability issues facing developers. We then design Cesar, a system offering developers a visual analysis environment to support their quest to rid their code of vulnerabilities. We present a prototype implementation of Cesar, and perform a usability analysis of the prototype and the visualizations it employs. Our analysis shows that the prototype is promising in promoting collaboration, exploration, and enabling developers to focus on the overall quality of their code as well as inspect individual vulnerabilities. We finally provide general recommendations to guide future designs of code review tools to enhance their usability.

With millions of mobile applications available for download, and the proliferation of these types of software in our daily lives, it is becoming increasingly important to ensure the security of these applications. Previous research showed that developers have little knowledge of security and privacy regulations, and existing vulnerability detection tools have usability issues that prevent developers from using them. In my research I look at the human factor; e.g., how developers conduct security reviews of their code and what issues they face when using existing tools. In addition, I aim to develop tools and methodologies that support vulnerability detection while seamlessly integrating with the Software Development Lifecycle.

We explore mobile privacy through a survey and through usability evaluation of three privacy-preserving mobile applications. Our survey explores users' knowledge of privacy risks, as well as their attitudes and motivations to protect their privacy on mobile devices. We found that users have incomplete mental models of privacy risks associated with such devices. And, although participants believe they are primarily responsible for protecting their own privacy, there is a clear gap between their perceived privacy risks and the defenses they employ. For example, only 6% of participants use privacy-preserving applications on their mobile devices, but 83% are concerned about privacy. Our usability studies show that mobile privacy-preserving tools fail to fulfill fundamental usability goals such as learnability and intuitiveness---potential reasons for their low adoption rates. Through a better understanding of users' perception and attitude towards privacy risks, we aim to inform the design of privacy-preserving mobile applications. We look at these tools through users' eyes, and provide recommendations to improve their usability and increase user-acceptance.