{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,8,22]],"date-time":"2025-08-22T05:10:36Z","timestamp":1755839436220,"version":"3.41.0"},"publisher-location":"New York, NY, USA","reference-count":78,"publisher":"ACM","license":[{"start":{"date-parts":[[2022,11,7]],"date-time":"2022-11-07T00:00:00Z","timestamp":1667779200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["CNS-1801545"],"award-info":[{"award-number":["CNS-1801545"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2022,11,7]]},"DOI":"10.1145\/3548606.3560569","type":"proceedings-article","created":{"date-parts":[[2022,11,7]],"date-time":"2022-11-07T11:41:28Z","timestamp":1667821288000},"page":"1141-1155","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":5,"title":["Understanding the How and the Why"],"prefix":"10.1145","author":[{"given":"Kelsey R.","family":"Fulton","sequence":"first","affiliation":[{"name":"University of Maryland, College Park, MD, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Daniel","family":"Votipka","sequence":"additional","affiliation":[{"name":"Tufts University, Medford, MA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Desiree","family":"Abrokwa","sequence":"additional","affiliation":[{"name":"University of Maryland, College Park, MD, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Michelle L.","family":"Mazurek","sequence":"additional","affiliation":[{"name":"University of Maryland, College Park, MD, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Michael","family":"Hicks","sequence":"additional","affiliation":[{"name":"University of Maryland and Amazon, College Park, MD, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"James","family":"Parker","sequence":"additional","affiliation":[{"name":"Galois, Inc., Portland, OR, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2022,11,7]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.52"},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.25"},{"key":"e_1_3_2_1_3_1","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Alexopoulos Nikolaos","year":"2022","unstructured":"Nikolaos Alexopoulos , Manuel Brack , Jan Philipp Wagner , Tim Grube , and Max M\u00fchlh\u00e4user . 2022 . How Long Do Vulnerabilities Live in the Code? A {Large-Scale} Empirical Measurement Study on {FOSS} Vulnerability Lifetimes . In 31st USENIX Security Symposium (USENIX Security 22) . 359--376. Nikolaos Alexopoulos, Manuel Brack, Jan Philipp Wagner, Tim Grube, and Max M\u00fchlh\u00e4user. 2022. How Long Do Vulnerabilities Live in the Code? A {Large-Scale} Empirical Measurement Study on {FOSS} Vulnerability Lifetimes. In 31st USENIX Security Symposium (USENIX Security 22). 359--376."},{"key":"e_1_3_2_1_4_1","volume-title":"Sixteenth Symposium on Usable Privacy and Security (SOUPS","author":"Alomar Noura","year":"2020","unstructured":"Noura Alomar , Primal Wijesekera , Edward Qiu , and Serge Egelman . 2020 . \" You've got your nice list of bugs, now what?\" vulnerability discovery and management processes in the wild . In Sixteenth Symposium on Usable Privacy and Security (SOUPS 2020). 319--339. Noura Alomar, Primal Wijesekera, Edward Qiu, and Serge Egelman. 2020. \"You've got your nice list of bugs, now what?\" vulnerability discovery and management processes in the wild. In Sixteenth Symposium on Usable Privacy and Security (SOUPS 2020). 319--339."},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"crossref","unstructured":"Nuno Antunes and Marco Vieira. 2009. Comparing the effectiveness of penetration testing and static code analysis on the detection of sql injection vulnerabilities in web services. In 2009 15th IEEE pacific rim international symposium on dependable computing. IEEE 301--306.  Nuno Antunes and Marco Vieira. 2009. Comparing the effectiveness of penetration testing and static code analysis on the detection of sql injection vulnerabilities in web services. In 2009 15th IEEE pacific rim international symposium on dependable computing. IEEE 301--306.","DOI":"10.1109\/PRDC.2009.54"},{"key":"e_1_3_2_1_6_1","volume-title":"Fourteenth symposium on usable privacy and security (SOUPS","author":"Assal Hala","year":"2018","unstructured":"Hala Assal and Sonia Chiasson . 2018 . Security in the software development lifecycle . In Fourteenth symposium on usable privacy and security (SOUPS 2018). 281--296. Hala Assal and Sonia Chiasson. 2018. Security in the software development lifecycle. In Fourteenth symposium on usable privacy and security (SOUPS 2018). 281--296."},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1145\/3290605.3300519"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1109\/ESEM.2011.18"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1002\/spe.2109"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/563340.563354"},{"key":"e_1_3_2_1_11_1","volume-title":"USENIX Security Symposium.","author":"Binkhorst Veroniek","year":"2022","unstructured":"Veroniek Binkhorst , Tobias Fiebig , Katharina Krombholz , Wolter Pieters , 2022 . Security at the end of the tunnel: The anatomy of VPN mental models among experts and non-experts in a corporate context . In USENIX Security Symposium. Veroniek Binkhorst, Tobias Fiebig, Katharina Krombholz, Wolter Pieters, et al. 2022. Security at the end of the tunnel: The anatomy of VPN mental models among experts and non-experts in a corporate context. In USENIX Security Symposium."},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1145\/567067.567069"},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1002\/j.2168-9830.2009.tb01005.x"},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1080\/08993408.2012.665210"},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1109\/PASSAT\/SocialCom.2011.184"},{"key":"e_1_3_2_1_19_1","unstructured":"Kathy Charmaz. 2006. Constructing grounded theory: A practical guide through qualitative analysis. sage.  Kathy Charmaz. 2006. Constructing grounded theory: A practical guide through qualitative analysis. sage."},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/1920261.1920299"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1177\/001316446302300306"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-14215-4_7"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/2960310.2960317"},{"volume-title":"The Cambridge handbook of computing education research","author":"Fincher Sally A","key":"e_1_3_2_1_24_1","unstructured":"Sally A Fincher and Anthony V Robins . 2019. The Cambridge handbook of computing education research . Cambridge University Press . Sally A Fincher and Anthony V Robins. 2019. The Cambridge handbook of computing education research. Cambridge University Press."},{"key":"e_1_3_2_1_25_1","volume-title":"Metacognitive aspects of problem solving. The nature of intelligence","author":"Flavell John H","year":"1976","unstructured":"John H Flavell . 1976. Metacognitive aspects of problem solving. The nature of intelligence ( 1976 ). John H Flavell. 1976. Metacognitive aspects of problem solving. The nature of intelligence (1976)."},{"key":"e_1_3_2_1_26_1","unstructured":"GitLab. 2022. What are git version control best practices? https:\/\/about.gitlab.com\/topics\/version-control\/version-control-best-practices\/.  GitLab. 2022. What are git version control best practices? https:\/\/about.gitlab.com\/topics\/version-control\/version-control-best-practices\/."},{"key":"e_1_3_2_1_27_1","unstructured":"Google. 2020. Go Programming Language. https:\/\/golang.org\/.  Google. 2020. Go Programming Language. https:\/\/golang.org\/."},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1016\/S1389-0417(99)00005-4"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2016.111"},{"key":"e_1_3_2_1_30_1","volume-title":"Fourteenth Symposium on Usable Privacy and Security (SOUPS","author":"Haney Julie M","year":"2018","unstructured":"Julie M Haney , Mary Theofanos , Yasemin Acar , and Sandra Spickard Prettyman . 2018 . \" we make it a big deal in the company\": Security mindsets in organizations that develop cryptographic products . In Fourteenth Symposium on Usable Privacy and Security (SOUPS 2018). 357--373. Julie M Haney, Mary Theofanos, Yasemin Acar, and Sandra Spickard Prettyman. 2018. \"we make it a big deal in the company\": Security mindsets in organizations that develop cryptographic products. In Fourteenth Symposium on Usable Privacy and Security (SOUPS 2018). 357--373."},{"key":"e_1_3_2_1_31_1","volume-title":"Answering the call for a standard reliability measure for coding data. Communication methods and measures","author":"Hayes Andrew F","year":"2007","unstructured":"Andrew F Hayes and Klaus Krippendorff . 2007. Answering the call for a standard reliability measure for coding data. Communication methods and measures , Vol. 1 , 1 ( 2007 ), 77--89. Andrew F Hayes and Klaus Krippendorff. 2007. Answering the call for a standard reliability measure for coding data. Communication methods and measures, Vol. 1, 1 (2007), 77--89."},{"key":"e_1_3_2_1_32_1","volume-title":"Hurdles for developers in cryptography. arXiv preprint arXiv:2108.07141","author":"Hazhirpasand Mohammadreza","year":"2021","unstructured":"Mohammadreza Hazhirpasand , Oscar Nierstrasz , Mohammadhossein Shabani , and Mohammad Ghafari . 2021. Hurdles for developers in cryptography. arXiv preprint arXiv:2108.07141 ( 2021 ). Mohammadreza Hazhirpasand, Oscar Nierstrasz, Mohammadhossein Shabani, and Mohammad Ghafari. 2021. Hurdles for developers in cryptography. arXiv preprint arXiv:2108.07141 (2021)."},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.28945\/244"},{"key":"e_1_3_2_1_34_1","unstructured":"Melanie Jones. 2019. Why Cybersecurity Education Matters. https:\/\/www.itproportal.com\/features\/why-cybersecurity-education-matters\/.  Melanie Jones. 2019. Why Cybersecurity Education Matters. https:\/\/www.itproportal.com\/features\/why-cybersecurity-education-matters\/."},{"key":"e_1_3_2_1_35_1","unstructured":"Harjot Kaur Sabrina Amft Daniel Votipka Yasemin Acar and Sascha Fahl. 2022. Where to Recruit for Security Development Studies: Comparing Six Software Developer Samples. (2022).  Harjot Kaur Sabrina Amft Daniel Votipka Yasemin Acar and Sascha Fahl. 2022. Where to Recruit for Security Development Studies: Comparing Six Software Developer Samples. (2022)."},{"key":"e_1_3_2_1_36_1","volume-title":"Thirteenth symposium on usable privacy and security (soups","author":"Lastdrager Elmer","year":"2017","unstructured":"Elmer Lastdrager , In\u00e9s Carvajal Gallardo , Pieter Hartel , and Marianne Junger . 2017 . How Effective is {Anti-Phishing} Training for Children? . In Thirteenth symposium on usable privacy and security (soups 2017). 229--239. Elmer Lastdrager, In\u00e9s Carvajal Gallardo, Pieter Hartel, and Marianne Junger. 2017. How Effective is {Anti-Phishing} Training for Children?. In Thirteenth symposium on usable privacy and security (soups 2017). 229--239."},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-020-09810-1"},{"key":"e_1_3_2_1_38_1","volume-title":"Jinjuan Heidi Feng, and Harry Hochheiser","author":"Lazar Jonathan","year":"2017","unstructured":"Jonathan Lazar , Jinjuan Heidi Feng, and Harry Hochheiser . 2017 . Research methods in human-computer interaction. Morgan Kaufmann . Jonathan Lazar, Jinjuan Heidi Feng, and Harry Hochheiser. 2017. Research methods in human-computer interaction. Morgan Kaufmann."},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"crossref","unstructured":"Timothy C Lethbridge Jorge Diaz-Herrera J Richard Jr J Barrie Thompson etal 2007. Improving software practice through education: Challenges and future trends. In Future of Software Engineering (FOSE'07). IEEE 12--28.  Timothy C Lethbridge Jorge Diaz-Herrera J Richard Jr J Barrie Thompson et al. 2007. Improving software practice through education: Challenges and future trends. In Future of Software Engineering (FOSE'07). IEEE 12--28.","DOI":"10.1109\/FOSE.2007.13"},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134072"},{"key":"e_1_3_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1145\/3359174"},{"key":"e_1_3_2_1_42_1","unstructured":"Gary McGraw Sammy Migues and Brian Chess. 2009. Software Security Framework | BSIMM. https:\/\/www.bsimm.com\/framework.html (Accessed 05-22-2018).  Gary McGraw Sammy Migues and Brian Chess. 2009. Software Security Framework | BSIMM. https:\/\/www.bsimm.com\/framework.html (Accessed 05-22-2018)."},{"key":"e_1_3_2_1_43_1","unstructured":"G McGraw and J Steven. 2011. Software [in] security: Comparing apples oranges and aardvarks (or all static analysis tools are not created equal.  G McGraw and J Steven. 2011. Software [in] security: Comparing apples oranges and aardvarks (or all static analysis tools are not created equal."},{"key":"e_1_3_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1109\/ESEM.2013.19"},{"key":"e_1_3_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1145\/2661685.2661687"},{"key":"e_1_3_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1145\/2382756.2382785"},{"key":"e_1_3_2_1_47_1","volume-title":"Fifteenth Symposium on Usable Privacy and Security (SOUPS","author":"Mhaidli Abraham H","year":"2019","unstructured":"Abraham H Mhaidli , Yixin Zou , and Florian Schaub . 2019 . \" We Can't Live Without {Them!}\" App Developers' Adoption of Ad Networks and Their Considerations of Consumer Risks . In Fifteenth Symposium on Usable Privacy and Security (SOUPS 2019). 225--244. Abraham H Mhaidli, Yixin Zou, and Florian Schaub. 2019. \"We Can't Live Without {Them!}\" App Developers' Adoption of Ad Networks and Their Considerations of Consumer Risks. In Fifteenth Symposium on Usable Privacy and Security (SOUPS 2019). 225--244."},{"key":"e_1_3_2_1_48_1","unstructured":"Microsoft. 2019. Microsoft Security Development Lifecycle Practices. https:\/\/www.microsoft.com\/en-us\/securityengineering\/sdl\/practices.  Microsoft. 2019. Microsoft Security Development Lifecycle Practices. https:\/\/www.microsoft.com\/en-us\/securityengineering\/sdl\/practices."},{"key":"e_1_3_2_1_49_1","unstructured":"Mitre. 2020. CVE. https:\/\/cve.mitre.org\/.  Mitre. 2020. CVE. https:\/\/cve.mitre.org\/."},{"key":"e_1_3_2_1_50_1","unstructured":"Mozilla. 2020. Rust Programming Language. https:\/\/www.rust-lang.org\/.  Mozilla. 2020. Rust Programming Language. https:\/\/www.rust-lang.org\/."},{"volume-title":"The coding manual for qualitative researchers 2 ed.)","author":"Johnny Salda","key":"e_1_3_2_1_51_1","unstructured":"Johnny Salda na. 2014. The coding manual for qualitative researchers 2 ed.) . Sage . Johnny Salda na. 2014. The coding manual for qualitative researchers 2 ed.). Sage."},{"key":"e_1_3_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.1145\/3313831.3376791"},{"key":"e_1_3_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.1145\/3290605.3300370"},{"key":"e_1_3_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134082"},{"key":"e_1_3_2_1_55_1","volume-title":"Fourteenth Symposium on Usable Privacy and Security (SOUPS","author":"Naiakshina Alena","year":"2018","unstructured":"Alena Naiakshina , Anastasia Danilova , Christian Tiefenau , and Matthew Smith . 2018 . Deception task design in developer password studies: Exploring a student sample . In Fourteenth Symposium on Usable Privacy and Security (SOUPS 2018). 297--313. Alena Naiakshina, Anastasia Danilova, Christian Tiefenau, and Matthew Smith. 2018. Deception task design in developer password studies: Exploring a student sample. In Fourteenth Symposium on Usable Privacy and Security (SOUPS 2018). 297--313."},{"key":"e_1_3_2_1_56_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2015.48"},{"key":"e_1_3_2_1_57_1","volume-title":"Proceedings of the 2009 USENIX Annual Technical Conference (USENIX ATC). 383--396","author":"Neuhaus Stephan","year":"2009","unstructured":"Stephan Neuhaus and Thomas Zimmermann . 2009 . The beauty and the beast: vulnerabilities in red hat's packages . In Proceedings of the 2009 USENIX Annual Technical Conference (USENIX ATC). 383--396 . Stephan Neuhaus and Thomas Zimmermann. 2009. The beauty and the beast: vulnerabilities in red hat's packages. In Proceedings of the 2009 USENIX Annual Technical Conference (USENIX ATC). 383--396."},{"key":"e_1_3_2_1_58_1","doi-asserted-by":"publisher","DOI":"10.1145\/1315245.1315311"},{"key":"e_1_3_2_1_60_1","unstructured":"NIST. 2020. National Vulnerability Database. https:\/\/nvd.nist.gov\/general.  NIST. 2020. National Vulnerability Database. https:\/\/nvd.nist.gov\/general."},{"key":"e_1_3_2_1_61_1","volume-title":"API Blindspots: Why Experienced Developers Write Vulnerable Code. In Fourteenth Symposium on Usable Privacy and Security (SOUPS 2018","author":"Oliveira Daniela Seabra","year":"2018","unstructured":"Daniela Seabra Oliveira , Tian Lin , Muhammad Sajidur Rahman , Rad Akefirad , Donovan Ellis , Eliany Perez , Rahul Bobhate , Lois A. DeLong , Justin Cappos , and Yuriy Brun . 2018 . API Blindspots: Why Experienced Developers Write Vulnerable Code. In Fourteenth Symposium on Usable Privacy and Security (SOUPS 2018 ). USENIX Association, Baltimore, MD, 315--328. https:\/\/www.usenix.org\/conference\/soups 2018\/presentation\/oliveira Daniela Seabra Oliveira, Tian Lin, Muhammad Sajidur Rahman, Rad Akefirad, Donovan Ellis, Eliany Perez, Rahul Bobhate, Lois A. DeLong, Justin Cappos, and Yuriy Brun. 2018. API Blindspots: Why Experienced Developers Write Vulnerable Code. In Fourteenth Symposium on Usable Privacy and Security (SOUPS 2018). USENIX Association, Baltimore, MD, 315--328. https:\/\/www.usenix.org\/conference\/soups2018\/presentation\/oliveira"},{"key":"e_1_3_2_1_62_1","volume-title":"USENIX Security Symposium","volume":"6","author":"Ozment Andy","year":"2006","unstructured":"Andy Ozment and Stuart E Schechter . 2006 . Milk or wine: does software security improve with age? . In USENIX Security Symposium , Vol. 6 . 10--5555. Andy Ozment and Stuart E Schechter. 2006. Milk or wine: does software security improve with age?. In USENIX Security Symposium, Vol. 6. 10--5555."},{"key":"e_1_3_2_1_63_1","volume-title":"Sixteenth Symposium on Usable Privacy and Security (SOUPS","author":"Palombo Hernan","year":"2020","unstructured":"Hernan Palombo , Armin Ziaie Tabari , Daniel Lende , Jay Ligatti , and Xinming Ou . 2020 . An Ethnographic Understanding of Software ({In) Security} and a {Co-Creation} Model to Improve Secure Software Development . In Sixteenth Symposium on Usable Privacy and Security (SOUPS 2020). 205--220. Hernan Palombo, Armin Ziaie Tabari, Daniel Lende, Jay Ligatti, and Xinming Ou. 2020. An Ethnographic Understanding of Software ({In) Security} and a {Co-Creation} Model to Improve Secure Software Development. In Sixteenth Symposium on Usable Privacy and Security (SOUPS 2020). 205--220."},{"key":"e_1_3_2_1_64_1","doi-asserted-by":"publisher","DOI":"10.1037\/dev0000081"},{"key":"e_1_3_2_1_66_1","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978382"},{"key":"e_1_3_2_1_67_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISSRE.2004.1"},{"key":"e_1_3_2_1_68_1","volume-title":"Teachability of reflective processes in written composition. Cognitive science","author":"Scardamalia Marlene","year":"1984","unstructured":"Marlene Scardamalia , Carl Bereiter , and Rosanne Steinbach . 1984. Teachability of reflective processes in written composition. Cognitive science , Vol. 8 , 2 ( 1984 ), 173--190. Marlene Scardamalia, Carl Bereiter, and Rosanne Steinbach. 1984. Teachability of reflective processes in written composition. Cognitive science, Vol. 8, 2 (1984), 173--190."},{"key":"e_1_3_2_1_69_1","doi-asserted-by":"publisher","DOI":"10.1145\/1159733.1159739"},{"key":"e_1_3_2_1_70_1","doi-asserted-by":"publisher","DOI":"10.1145\/1288580.1288585"},{"key":"e_1_3_2_1_71_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2012.6227141"},{"key":"e_1_3_2_1_72_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134105"},{"volume-title":"Usable SecuritytextemdashThe Source Awakens","author":"Smith Matthew","key":"e_1_3_2_1_73_1","unstructured":"Matthew Smith . 2016. Usable SecuritytextemdashThe Source Awakens . USENIX Association , San Francisco, CA . Matthew Smith. 2016. Usable SecuritytextemdashThe Source Awakens. USENIX Association, San Francisco, CA."},{"key":"e_1_3_2_1_74_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2013.6606687"},{"key":"e_1_3_2_1_75_1","doi-asserted-by":"publisher","DOI":"10.1145\/6138.6145"},{"key":"e_1_3_2_1_76_1","volume-title":"27th USENIX Security Symposium (USENIX Security 18)","author":"Stevens Rock","year":"2018","unstructured":"Rock Stevens , Daniel Votipka , Elissa M Redmiles , Colin Ahern , Patrick Sweeney , and Michelle L Mazurek . 2018 . The battle for new york: a case study of applied digital threat modeling at the enterprise level . In 27th USENIX Security Symposium (USENIX Security 18) . 621--637. Rock Stevens, Daniel Votipka, Elissa M Redmiles, Colin Ahern, Patrick Sweeney, and Michelle L Mazurek. 2018. The battle for new york: a case study of applied digital threat modeling at the enterprise level. In 27th USENIX Security Symposium (USENIX Security 18). 621--637."},{"key":"e_1_3_2_1_77_1","volume-title":"Analyzing the effectiveness and coverage of web application security scanners","author":"Suto Larry","year":"2007","unstructured":"Larry Suto . 2007. Analyzing the effectiveness and coverage of web application security scanners . San Francisco , October ( 2007 ). Larry Suto. 2007. Analyzing the effectiveness and coverage of web application security scanners. San Francisco, October (2007)."},{"key":"e_1_3_2_1_78_1","volume-title":"Analyzing the accuracy and time costs of web application security scanners","author":"Suto Larry","year":"2010","unstructured":"Larry Suto . 2010. Analyzing the accuracy and time costs of web application security scanners . San Francisco , February ( 2010 ). Larry Suto. 2010. Analyzing the accuracy and time costs of web application security scanners. San Francisco, February (2010)."},{"key":"e_1_3_2_1_79_1","doi-asserted-by":"publisher","DOI":"10.1145\/3491102.3501957"},{"key":"e_1_3_2_1_80_1","doi-asserted-by":"publisher","DOI":"10.15388\/infedu.2005.09"},{"key":"e_1_3_2_1_81_1","volume-title":"Seventeenth Symposium on Usable Privacy and Security (SOUPS","author":"Tuladhar Anwesh","year":"2021","unstructured":"Anwesh Tuladhar , Daniel Lende , Jay Ligatti , and Xinming Ou . 2021 . An Analysis of the Role of Situated Learning in Starting a Security Culture in a Software Company . In Seventeenth Symposium on Usable Privacy and Security (SOUPS 2021). 617--632. Anwesh Tuladhar, Daniel Lende, Jay Ligatti, and Xinming Ou. 2021. An Analysis of the Role of Situated Learning in Starting a Security Culture in a Software Company. In Seventeenth Symposium on Usable Privacy and Security (SOUPS 2021). 617--632."},{"volume-title":"29th {USENIX} Security Symposium ({USENIX} Security 20). 109--126.","author":"Votipka Daniel","key":"e_1_3_2_1_82_1","unstructured":"Daniel Votipka , Kelsey R Fulton , James Parker , Matthew Hou , Michelle L Mazurek , and Michael Hicks . 2020. Understanding security mistakes developers make: Qualitative analysis from build it, break it, fix it . In 29th {USENIX} Security Symposium ({USENIX} Security 20). 109--126. Daniel Votipka, Kelsey R Fulton, James Parker, Matthew Hou, Michelle L Mazurek, and Michael Hicks. 2020. Understanding security mistakes developers make: Qualitative analysis from build it, break it, fix it. In 29th {USENIX} Security Symposium ({USENIX} Security 20). 109--126."},{"key":"e_1_3_2_1_83_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICST.2010.32"}],"event":{"name":"CCS '22: 2022 ACM SIGSAC Conference on Computer and Communications Security","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"],"location":"Los Angeles CA USA","acronym":"CCS '22"},"container-title":["Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3548606.3560569","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3548606.3560569","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3548606.3560569","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T17:50:57Z","timestamp":1750182657000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3548606.3560569"}},"subtitle":["Exploring Secure Development Practices through a Course Competition"],"short-title":[],"issued":{"date-parts":[[2022,11,7]]},"references-count":78,"alternative-id":["10.1145\/3548606.3560569","10.1145\/3548606"],"URL":"https:\/\/doi.org\/10.1145\/3548606.3560569","relation":{},"subject":[],"published":{"date-parts":[[2022,11,7]]},"assertion":[{"value":"2022-11-07","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}