The goal of this Dagstuhl Seminar is to bring together members of three communities – academic researchers in cybersecurity, industrial practitioners and software engineering researchers – to tackle the problem of empirically evaluating secure development processes.

In the past decades, the cybersecurity community has created many principles and practices for developing secure software. However, this knowledge has generally been assembled by the application of common sense and experience, and while individual measures and techniques are often based on real-world data and root-cause analysis, broader strategies and processes for creating secure software and assessing software security are usually not subjected to rigorous evaluation. This is a serious shortcoming: common sense can be mistaken and experiences over-generalized. Evaluation techniques are necessary to provide a firm scientific basis that can support progress in the field.

Some such techniques do exist for the later software development stages – implementation and testing. Here one enjoys good automation, and the mapping between technique and end-product is relatively clear-cut. It is also in these stages where security teams succeed at least partially in providing software developers with concrete prescriptive guidance. Nonetheless, the earlier developmental stages – requirements elicitation, threat modeling, architecture – are at least as critical to the security of the final product if not more so, yet pose a much greater experimental challenge because of the gap between the process and product. Experience has shown only limited success at incorporating security into these crucial initial stages.

This seminar wants to enable conversations between these three traditionally-separate communities and drive empirical research to help the developers of secure software. Through these conversations, we aim to bring empirical research practices already established in the software engineering community to the security research community, to make software engineering researchers aware of the important issues in software security, and to make academic researchers aware of the practical constraints and challenges faced by industry.

As a concrete eventual outcome of this Dagstuhl Seminar, we plan to produce an edited open-access book collecting essays of what we know and do not know about secure software practices and processes from a sound scientific empirical perspective. This volume will merge empirical software engineering and security research to assist the involved communities, including industry and academia, in focusing their research efforts, and help newcomers to our field find fertile research areas.

In order to do this, this seminar will engage participants in multiple breakout sessions, both free-form and more formally organized, to foster discussions and generate ideas. By seminar end, we intend to have produced the book outline and multi-disciplinary teams that will work together to complete it.

Creative Commons BY 4.0

Eric Bodden, Brendan Murphy, Sam Weber, Laurie Williams, and Steve Lipner

• Yasemin Acar (George Washington University, DC, US) [dblp]
• Evan Austin (NRL - Washington, US)
• Alexandre Bartel (University of Umeå, SE) [dblp]
• Thorsten Berger (Ruhr-Universität Bochum, DE) [dblp]
• Robert Biddle (Carleton University - Ottawa, CA) [dblp]
• Eric Bodden (Universität Paderborn, DE) [dblp]
• Haipeng Cai (Washington State University - Pullman, US) [dblp]
• Michael Coblenz (University of California - San Diego, US) [dblp]
• Daniela Soares Cruzes (NTNU - Trondheim, NO) [dblp]
• Joanna Cecilia da Silva Santos (University of Notre Dame, US) [dblp]
• Sascha Fahl (Leibniz Universität Hannover, DE) [dblp]
• Olga Gadyatskaya (Leiden University, NL) [dblp]
• Matthias Galster (University of Canterbury - Christchurch, NZ) [dblp]
• Alex Gantman (Qualcomm Research - San Diego, US)
• Alessandra Gorla (IMDEA Software Institute - Madrid, ES) [dblp]
• Ben Hermann (TU Dortmund, DE) [dblp]
• Kevin Hermann (Ruhr-Universität Bochum, DE)
• Johannes Kinder (LMU München, DE) [dblp]
• Jacques Klein (University of Luxembourg, LU) [dblp]
• Piergiorgio Ladisa (SAP Labs France - Mougins, FR) [dblp]
• David Lo (SMU - Singapore, SG) [dblp]
• Tamara Lopez (The Open University - Milton Keynes, GB) [dblp]
• Fabio Massacci (VU University Amsterdam, NL) [dblp]
• Tim Menzies (North Carolina State University - Raleigh, US) [dblp]
• Mehdi Mirakhorli (Rochester Institute of Technology, US) [dblp]
• Alena Naiakshina (Ruhr-Universität Bochum, DE) [dblp]
• Ranindya Paramitha (University of Trento, IT)
• Liliana Pasquale (University College Dublin, IE) [dblp]
• Sven Peldszus (Ruhr-Universität Bochum, DE)
• Henrik Plate (Endor Labs - Palo Alto, US) [dblp]
• Akond Rahman (Auburn University, US) [dblp]
• Awais Rashid (University of Bristol, GB) [dblp]
• Brad Reaves (North Carolina State University - Raleigh, US) [dblp]
• Heather Richter Lipford (University of North Carolina - Charlotte, US) [dblp]
• Daniel Votipka (Tufts University - Medford, US) [dblp]
• Sam Weber (Carnegie Mellon University - Pittsburgh, US) [dblp]
• Charles Weir (Lancaster University, GB) [dblp]
• Dominik Wermke (CISPA - Saarbrücken, DE) [dblp]
• Laurie Williams (North Carolina State University - Raleigh, US) [dblp]