arXiv subjects

Winnie Mbaka

Publications and source records attributed to Winnie Mbaka.

4 recordsLinked to original sources

arXiv2026

On the Abolition of the "ICSE Paper" and the Adoption of the "Registered Proposal" and the "Results Report"

To address the 'novelty-vicious cycle' and the 'replicability crisis' of the field (both discussed in the survey) we propose abolishing the "ICSE paper" as we know it and replacing it with a two-tier system that also evolves the existing notion of 'Registered Report'. Authors proposing a new idea, experiment, or analysis would submit a "Registered Proposal" of their idea and the proposed experimental methodology to undergo peer review. The following year, anyone can submit (shorter) "Results Reports" on the realization of the empirical work based on the registered proposals of the previous ICSE (or FSE or ISSTA or ASE etc.). Both works should be first class citizens of the mainstream events. We argue that such a disruptive (heretical?) idea is supported and based on the responses of the community of the Future of Software Engineering pre-survey

cs.SE↗

arXiv2023

Impact of Gender on the Evaluation of Security Decisions

Security decisions are made by human analysts under uncertain conditions which leaves room for bias judgement. However, little is known about how demographics like gender and education impact these judgments. We conducted an empirical study to investigate their influence on security decision evaluations, addressing this knowledge gap.

cs.CY↗

arXiv2022

Human Aspect of Threat Analysis: A Replication

Background: Organizations are experiencing an increasing demand for security-by-design activities (e.g., STRIDE analyses) which require a high manual effort. This situation is worsened by the current lack of diverse (and sufficient) security workforce and inconclusive results from past studies. To date, the deciding human factors (e.g., diversity dimensions) that play a role in threat analysis have not been sufficiently explored. Objective: To address this issue, we plan to conduct a series of exploratory controlled experiments. The main objective is to empirically measure the human-aspects that play a role in threat analysis alongside the more well-known measures of analysis performance. Method: We design the experiments as a differentiated replication of past experiments with STRIDE. The replication design is aimed at capturing some similar measures (e.g., of outcome quality) and additional measures (e.g., diversity dimensions). We plan to conduct the experiments in an academic setting. Limitations: Obtaining a balanced population (e.g., wrt gender) in advanced computer science courses is not realistic. The experiments we plan to conduct with MSc level students will certainly suffer this limitation.

cs.SE↗

arXiv2022

A replication of a controlled experiment with two STRIDE variants

To avoid costly security patching after software deployment, security-by-design techniques (e.g., STRIDE threat analysis) are adopted in organizations to root out security issues before the system is ever implemented. Despite the global gap in cybersecurity workforce and the high manual effort required for performing threat analysis, organizations are ramping up threat analysis activities. However, past experimental results were inconclusive regarding some performance indicators of threat analysis techniques thus practitioners have little evidence for choosing the technique to adopt. To address this issue, we replicated a controlled experiment with STRIDE. Our study was aimed at measuring and comparing the performance indicators (productivity and precision) of two STRIDE variants (element and interaction). We conclude the paper by comparing our results to the original study.

cs.CR↗