SLR: From Saltzer and Schroeder to 2021…47 Years of Research on the Development and Validation of Security API Recommendations

Patnaik, Nikhil; Dwyer, Andrew; Hallett, Joseph; Rashid, Awais

Abstract

Producing secure software is challenging. The poor usability of security Application Programming Interfaces (APIs) makes this even harder. Many recommendations have been proposed to support developers by improving the usability of cryptography libraries—rooted in wider best practice guidance in software engineering and API design. In this SLR, we systematize knowledge regarding these recommendations. We identify and analyze 65 papers, offering 883 recommendations. Through thematic analysis, we identify seven core ways to improve usability of APIs. Most of the recommendations focus on helping API developers to construct and structure their code and make it more usable and easier for programmers to understand. There is less focus, however, on documentation, writing requirements, code quality assessment, and the impact of organizational software development practices. By tracing and analyzing paper ancestry, we map how this knowledge becomes validated and translated over time. We find that very few API usability recommendations are empirically validated, and that recommendations specific to usable security APIs lag even further behind.

Citation

Patnaik, N., Dwyer, A., Hallett, J., & Rashid, A. (2023). SLR: From Saltzer and Schroeder to 2021…47 Years of Research on the Development and Validation of Security API Recommendations. ACM Transactions on Software Engineering and Methodology, 32(3), 1-31. https://doi.org/10.1145/3561383

• Journal Article Type: Article
• Acceptance Date: Jul 15, 2022
• Online Publication Date: Apr 27, 2023
• Publication Date: Jul 31, 2023
• Deposit Date: Mar 22, 2024
• Journal: ACM Transactions on Software Engineering and Methodology
• Print ISSN: 1049-331X
• Electronic ISSN: 1557-7392
• Publisher: Association for Computing Machinery (ACM)
• Peer Reviewed: Peer Reviewed
• Volume: 32
• Issue: 3
• Article Number: 60
• Pages: 1-31
• DOI: https://doi.org/10.1145/3561383
• Keywords: Software
• Public URL: https://durham-repository.worktribe.com/output/2253164