[EN] ByteSized: Security by Design - Secure Data Principles for Digital Research with E Sheppard, M Hardaker

Ellie, I think you mentioned the key word that I would like to start our discussion with, which is security.

In the context of software, what do we actually mean when we say secure software?

When we say sort of secure software in a research context is about protecting what matters most to you in your specific context.

Not necessarily.

It's not always just sorting, you know, those hackers and those bad actors that are going to come in and try and get into your system.

It's thinking about within your software, within your data, what matters to you and how you

can

protect it.

So that might be the integrity of your results, your reproducibility and the confidence that you have in your own work and your own data set.

And really looking at those aspects and the best way you can look after it and protect it from technical measures, people measures and looking at your software from all those different angles.

Madeline, is there anything you would like to add?

Absolutely.

So like Ellie said, it is very context specific.

But when you start to think about what you're doing and the impact that you're trying to have with the product that you're creating, you have to just also think about what the unintended consequences might be as well.

And so when I think about secure software, I think about really optimizing that usefulness while also minimizing the potential for any downstream impact.

harms or unintended negative consequences.

Right.

How can software engineers go about this then? So anticipating the kind of dangers that may lie ahead, shall we say?

Again, it's going to be very context dependent, but always talk to whoever the subject matter experts are for their perspectives.

It may be that, you know, you, the developer are a one man band filling all those roles of expert and builder and creator and all of these things.

But in that case, I would still recommend getting perspectives from other people in your field who may have another angle to the kinds of questions that we would ask.

So some of the questions are, first of all, what are we protecting? Is it intellectual property? Is it data? Is it models? AI models are obviously a big thing these days and their outputs, infrastructure.

So all of these things have value.

And so we want to make sure that they are optimized and harms reduced.

And so identifying what those assets are is always the first step.

Ellie, I think you mentioned the key word that I would like to start our discussion with, which is security.

In the context of software, what do we actually mean when we say secure software?

When we say sort of secure software in a research context is about protecting what matters most to you in your specific context.

Not necessarily.

It's not always just sorting, you know, those hackers and those bad actors that are going to come in and try and get into your system.

It's thinking about within your software, within your data, what matters to you and how you

can

protect it.

So that might be the integrity of your results, your reproducibility and the confidence that you have in your own work and your own data set.

And really looking at those aspects and the best way you can look after it and protect it from technical measures, people measures and looking at your software from all those different angles.

Madeline, is there anything you would like to add?

Absolutely.

So like Ellie said, it is very context specific.

But when you start to think about what you're doing and the impact that you're trying to have with the product that you're creating, you have to just also think about what the unintended consequences might be as well.

And so when I think about secure software, I think about really optimizing that usefulness while also minimizing the potential for any downstream impact.

harms or unintended negative consequences.

Right.

How can software engineers go about this then? So anticipating the kind of dangers that may lie ahead, shall we say?

Again, it's going to be very context dependent, but always talk to whoever the subject matter experts are for their perspectives.

It may be that, you know, you, the developer are a one man band filling all those roles of expert and builder and creator and all of these things.

But in that case, I would still recommend getting perspectives from other people in your field who may have another angle to the kinds of questions that we would ask.

So some of the questions are, first of all, what are we protecting? Is it intellectual property? Is it data? Is it models? AI models are obviously a big thing these days and their outputs, infrastructure.

So all of these things have value.

And so we want to make sure that they are optimized and harms reduced.

And so identifying what those assets are is always the first step.