A Close Look at a Systematic Method for Analyzing Sets of Security Advice

TL;DR

This paper critically examines the SAcoding method for analyzing security advice, focusing on inter-coder agreement and suggesting improvements to enhance its objectivity and applicability.

Contribution

It provides an in-depth evaluation of the SAcoding method's reliability and proposes modifications to improve its consistency and utility in security advice analysis.

Findings

Moderate inter-coder agreement on advice categorization

Identified ambiguities in the coding tree structure

Recommendations for refining the coding methodology

Abstract

We carry out a detailed analysis of the security advice coding method (SAcoding) of Barrera et al. (2021), which is designed to analyze security advice in the sense of measuring actionability and categorizing advice items as practices, policies, principles, or outcomes. The main part of our analysis explores the extent to which a second coder's assignment of codes to advice items agrees with that of a first, for a dataset of 1013 security advice items nominally addressing Internet of Things devices. More broadly, we seek a deeper understanding of the soundness and utility of the SAcoding method, and the degree to which it meets the design goal of reducing subjectivity in assigning codes to security advice items. Our analysis results in suggestions for modifications to the coding tree methodology, and some recommendations. We believe the coding tree approach may be of interest for analysis of qualitative data beyond security advice datasets alone.