AI 中文总结
本文通过文献调研，揭示开发者未广泛采用静态应用安全测试（SAST）工具的障碍，指出需兼顾技术与人为因素以推动其广泛使用。
AI 中文摘要
开发者面临着一个尚无明确解决方案的棘手问题。现代软件漏洞可能给企业和个人带来严重破坏，由于代码漏洞是主要诱因，保护应用程序必须成为开发者的优先事项。静态应用安全测试（SAST）有潜力通过协助识别和解决安全漏洞来强化应用程序。尽管如此，许多开发团队尚未在其环境中采用SAST工具。本文对近期文献进行了调研，以揭示部分开发者对SAST持担忧态度的原因，并确定他们使用SAST时遇到的具体问题。我们发现开发者使用SAST时面临多种可用性问题，其中一些是工具固有的，最终需要开发者投入一定精力，另一些则是SAST工具开发者必须解决的工具缺陷。最终，我们认为，为推动SAST的广泛采用和持续使用，开发者需要认识到需要投入一定精力；同时，如果SAST工具开发者能简化与工具使用相关的诸多方面，开发者将更有可能将SAST工具集成到其工作流程中。克服阻碍SAST采用的主要障碍需要充分考虑技术和人为因素。
英文摘要
Developers face a challenging problem with no clear solution. Modern software breaches can wreak havoc on businesses and individuals alike. With code vulnerabilities being a leading cause, securing applications must be a priority for developers. Static Application Security Testing (SAST) has the potential to harden applications by assisting in the identification and resolution of security vulnerabilities. Despite this, many development teams have not adopted SAST tools into their environment. In this paper, we survey the recent literature to uncover why some developers are apprehensive towards SAST and identify what specific problems they encounter when using it. We found a variety of usability problems developers face when using SAST. Some are inherent of the tool and ultimately require some level of developer investment while others are tool shortcomings that SAST tool creators must address. Ultimately, we argue that in order to drive widespread adoption and consistent SAST usage, developers will need to embrace that some investment is required. Simultaneously, developers will be more likely to integrate SAST tools into their workflows if the creators of SAST tools simplify many aspects related to tool usage. Surmounting the primary obstacles preventing the adoption of SAST requires full consideration of both the technical and human factors.
Comments6 pages, 4 figures, published at 2024 39th IEEE/ACM International Conference on Automated Software Engineering Workshops (ASEW)
Journal ref39th IEEE/ACM International Conference on Automated Software Engineering Workshops (ASEW '24), Sacramento, CA, USA, 2024, pp. 161-166
