标题： 实践中的安全债务：从业者的深入见解 显示英文标题

标题： Security Debt in Practice: Nuanced Insights from Practitioners

摘要： 随着对软件和自动化的依赖不断增加，紧迫的截止日期、有限的资源以及功能优先于安全性的做法可能导致不安全的编码实践。 当未妥善处理时，这些限制会导致未解决的安全漏洞随时间积累，形成安全债务（SDs）。 尽管它们至关重要，但目前在现实环境中，软件从业者如何感知、管理以及沟通SDs的实证证据仍然有限。 在本文中，我们基于对来自不同角色、组织和国家的22名软件从业者的半结构化访谈，进行了一项定性实证研究。 我们解决了四个研究问题：i）我们评估软件从业者对SDs及其相关安全风险的知识和意识，ii）我们研究他们对待SDs的行为，iii）我们探讨用于缓解SDs的常用工具和策略，iv）我们分析安全风险在团队内部以及向决策者传达的方式。 我们观察到从业者对SDs的感知和管理存在差异，一些人更注重交付速度而非安全性，而另一些人则始终将安全性作为优先事项。 我们的研究结果强调了在软件开发生命周期（SDLC）中更强的安全实践整合的必要性，更一致地使用缓解策略，更好地平衡截止日期、资源和与安全相关的任务，并关注保密性、完整性、可用性（CIA）三元组。 显示英文摘要

摘要： With the increasing reliance on software and automation nowadays, tight deadlines, limited resources, and prioritization of functionality over security can lead to insecure coding practices. When not handled properly, these constraints cause unaddressed security vulnerabilities to accumulate over time, forming Security Debts (SDs). Despite their critical importance, there is limited empirical evidence on how software practitioners perceive, manage, and communicate SDs in real-world settings. In this paper, we present a qualitative empirical study based on semi-structured interviews with 22 software practitioners across various roles, organizations, and countries. We address four research questions: i) we assess software practitioners' knowledge of SDs and awareness of associated security risks, ii) we investigate their behavior towards SDs, iii) we explore common tools and strategies used to mitigate SDs, and iv) we analyze how security risks are communicated within teams and to decision makers. We observe variations in how practitioners perceive and manage SDs, with some prioritizing delivery speed over security, while others consistently maintain security as a priority. Our findings emphasize the need for stronger integration of security practices across the Software Development Life Cycle (SDLC), more consistent use of mitigation strategies, better balancing of deadlines, resources, and security-related tasks, with attention to the Confidentiality, Integrity, and Availability (CIA) triad.