Why Can’t Johnny Fix Vulnerabilities: A Usability Evaluation of Static Analysis Tools for Security

Static analysis tools can help prevent security incidents, but to do so, they must enable developers to resolve the defects they detect. Unfortunately, developers often struggle to interact with the interfaces of these tools, leading to tool abandonment, and consequently the proliferation of preventable vulnerabilities. Simply put, the usability of static analysis tools is crucial. The usable security community has successfully identified and remedied usability issues in end user security applications, like PGP and Tor browsers, by conducting usability evaluations. Inspired by the success of these studies, we conducted a heuristic walkthrough evaluation and user study focused on four security-oriented static analysis tools. Through the lens of these evaluations, we identify several issues that detract from the usability of static analysis tools. The issues we identified range from workflows that do not support developers to interface features that do not scale. We make these findings actionable by outlining how our results can be used to improve the state-of-the-art in static analysis tool interfaces.

Title	Why Can’t Johnny Fix Vulnerabilities: A Usability Evaluation of Static Analysis Tools for Security
Creator	Nguyen Quang Do, L.
	Smith, Justin
	Murphy Hill, E.
Publisher	Proceedings of the Sixteenth Symposium on Usable Privacy and Security
Academic Department	Computer Science
Division	Natural Sciences
Organization	Lafayette College
Date Issued	2020
Date Available	2021-06-30
Type	Article
Language	English
Bibliographic Citation	Smith, J., L. Nguyen Quang Do, and E. Murphy Hill (2020) “Why Can’t Johnny Fix Vulnerabilities: A Usability Evaluation of Static Analysis Tools for Security.” In Proceedings of the Sixteenth Symposium on Usable Privacy and Security (pp. 221-238). Berkeley, CA: USENIX Association. 221-238.
Standard Identifier	Handle 10385/41687j94q
Permalink	http://hdl.handle.net/10385/41687j94q
Rights Statement	In Copyright
Rights Holders	Nguyen Quang Do, L.
	Smith, Justin
	Murphy Hill, E.