An Ethnographic Understanding of Software (In)Security and a Co-Creation Model
summary
1.5 years of participant observation inside a small network-access software company produces concrete findings: two embedded PhD researchers analyze code repositories and tickets, perform pen‑tests, and find specific flaws — a permissive "silently allow" auth bypass, reflected/Angular XSS variants, and shell‑escape with hardcoded credentials on shipped appliances. Some fixes are accepted when a practicable patch fits the codebase; others are deferred for business or integration risk. The paper argues a co-creation model of embedded security experts reduces that friction.
AI-written summary · about
chapters (9)
- 0:00Start
- 0:52Software Vulnerabilities Are on the Rise
- 3:50Research Methods
- 5:09A Tale of Two Stories
- 6:59Advice Taken: SA Triggered by an Unimplemented Feature
- 7:46Advice Ignored: SA Triggered by Broken Integrations
- 9:08Advice Taken: XSS in the Web GUI
- 10:02Advice Ignored: Shellcode Injection
- 13:49Takeaway
related talks
33mInterview with
32mSoftware security as a force of nature
05mEnterprise security: A new hope
18mDesigning for Security Outcomes
25mSecurity First
49mPragmatic Approaches To Building Secure Software
41mThe Divine and Felonious Nature of Cyber Security
28mHow to Effect Change in the Epistemological Wasteland of App Security