Secure Software Development Research Articles

Evaluating the Role of Data Privacy Regulations in Secure Software Development Life Cycles (SDLC)

Evaluating the Role of Data Privacy Regulations in Secure Software Development Life Cycles (SDLC)

Automated Security Vulnerability Backlog Management

In today’s fast-paced development environments, security vulnerabilities often emerge at the same rapid rate as code updates. Security teams and developers face challenges in addressing these vulnerabilities while maintaining operational efficiency. Managing a security backlog manually can be cumbersome, slow, and prone to human error. Automating the security vulnerability backlog allows organizations to track, prioritize, and mitigate security risks more efficiently and effectively, ensuring a secure software development lifecycle (SDLC) without sacrificing agility. This white paper outlines the need for an automated security backlog, the benefits it provides, and strategies for implementing it using modern DevSecOps tools. Keywords — Automated security backlog, vulnerability management, CI/CD, DevSecOps, risk- based prioritization, SAST, DAST, software composition analysis, continuous security, vulnerability tracking, security remediation, cybersecurity automation, security risk management

Scientometric analysis of global cyber security research output based on Web of Science

Objective. This study aims to analyze global cyber security research using various scientometric indicators for 25 years, from 1999 to 2023. Design/Methodology/Approach. The study used the Web of Science international citation database to retrieve a total of 5,640 records. The records were extracted in the CSV file format and further analyzed using an MS-Excel spreadsheet, VosViewer, and Biblioshiny software. Findings. The findings revealed that a 300% annual growth rate was recorded for the publications in 2002. The USA emerged as the top contributor (31.15%) among the countries. The authors affiliated with the State University System of Florida have more publications (107 contributions). Authors Lingfeng Wang of the University of Wisconsin-Milwaukee and Kim-Kwang Raymond Choo of the University of Texas at San Antonio have contributed the equal and highest number of (21) papers. Originality/Value. Cyber security research helps to guardian the individual or nation’s digital sovereignty, protecting it against sophisticated cyber threats and potential attacks. The discipline has become the subject of global research. This study helps cyber security experts, software or web developers, and researchers identify the primary research evidence and its impact on the research community and policymakers for evidence-based policymaking to combat invisible global threats.

May the Source Be with You: On ChatGPT, Cybersecurity, and Secure Coding

Software security is an important topic that is gaining more and more attention due to the rising number of publicly known cybersecurity incidents. Previous research has shown that one way to address software security is by means of a serious game, the CyberSecurity Challenges, which are designed to raise awareness of software developers of secure coding guidelines. This game, proven to be very successful in the industry, makes use of an artificial intelligence technique (laddering technique) to implement a chatbot for human–machine interaction. Recent advances in machine learning have led to a breakthrough, with the implementation and release of large language models, now freely available to the public. Such models are trained on a large amount of data and are capable of analyzing and interpreting not only natural language but also source code in different programming languages. With the advent of ChatGPT, and previous state-of-the-art research in secure software development, a natural question arises: to what extent can ChatGPT aid software developers in writing secure software? In this work, we draw on our experience in the industry, and also on extensive previous work to analyze and reflect on how to use ChatGPT to aid secure software development. Towards this, we conduct two experiments with large language models. Our engagements with ChatGPT and our experience in the field allow us to draw conclusions on the advantages, disadvantages, and limitations of the usage of this new technology.

Security Based SCURM Process (SUBSCRUM) For Secure Agile Development

This study presents an integrated approach for the consideration of security during agile development. A security-based SCRUM process (SBSCRUM) is introduced by taking advantage of the security patterns presented by security experts which contains the solution for a security threat. In the proposed security based SCRUM process the SCRUM team will be responsible for identifying the expected security threats to the system, in which all the expected threats to the system are modelled using mis-use case diagrams and then these modelled threats are mitigated using the security patterns which provide detailed solution to mitigate the threats and at final stage the security testing is performed to ensure that all the security threats identified are mitigated using security patterns. SBSCRUM is evaluated through the case studies in this paper. SBSCRUM will enable the software developers to develop secure software using agile development methods which lacks in the past.

Comprehensive review of smart city cybersecurity strategies

With cities rapidly advancing technologically, the rise of smart cities brings innovative solutions to urban challenges. However, this integration of technologies within urban infrastructures introduces new cybersecurity risks. This review explores the cybersecurity issues that smart cities face and discusses strategies to address these threats. Smart cities rely on interconnected networks of devices and systems to enhance efficiency, sustainability, and citizen services. Yet, this connectivity also creates a complex environment that is vulnerable to cyberattacks. A key concern is the wide array of IoT devices deployed across smart city infrastructures, which often lack robust security mechanisms, making them susceptible to exploitation by cybercriminals. The interconnected nature of these systems heightens the potential impact of cyberattacks, posing significant risks to critical infrastructure, public safety, and privacy. Threat actors can exploit vulnerabilities in interconnected systems, disrupting essential services, manipulating data, or even causing physical harm. Since smart cities heavily depend on data-driven decision-making, ensuring data integrity and confidentiality is a top priority. To mitigate these risks, various cybersecurity strategies have been proposed and implemented. These include technical solutions, regulatory frameworks, and collaboration among stakeholders. Technical measures like encryption, authentication mechanisms, intrusion detection systems, and secure software development practices are essential. Additionally, strong access controls and network segmentation can limit the scope of potential attacks. Regulatory initiatives also play a crucial role in improving cybersecurity standards and ensuring compliance among stakeholders. Establishing clear guidelines for data protection, privacy rights, and incident response protocols is vital for safeguarding citizens' interests. Collaborative efforts between government agencies, the private sector, academia, and cybersecurity experts are crucial in sharing information and collectively defending against emerging threats. Securing smart cities requires a comprehensive approach that integrates technical measures, regulatory frameworks, and collaborative efforts to create a resilient and secure urban environment for all citizens. Keywords: Cybersecurity, Smart City, AI, Technology, Security.

Evaluation and Assessment of Software Security Risks and Vulnerabilities Within the Realm of Secure DevOps.

Security plays a vital role in successful software development and consistency, especially in a modern, fast-expanding world dominated by technologies. It guarantees that all privacy, integrity, and accessibility of information, coding, and services are protected. Achieving such requires a consistent consideration of security throughout all developmental stages of software. Although several methods for improving the quality of software have been created, there is still no clear method for effectively integrating security throughout each stage of the software developmental process. The inability to give adequate attention to security has been identified as the main cause of common flaws. Many forward-thinking businesses frequently employ a "patch and infiltrate” technique, taking security into consideration only after the execution of the task. Higher costs, project delays, neglect of verification and integration during the development life cycle of the project, reliance on external tools and parts, and ignorance among all factors contribute to the disregard of security during the SDLC. Nevertheless, Secure-DevOps is indispensable for the survival of companies in the Information and Communication Technology (ICT) landscape. Consequently, applying an effective approach that deals with security within every level of the SDLC is crucial. To bridge this gap, a comprehensive examination of effective techniques for developing secure software was presented, taking into account the financial and time constraints of a project. A framework for ensuring security built upon Secure-DevOps practices, which seamlessly integrates the best security measures into different stages of the SDLC, was identified. To validate this framework, a mathematical model has been employed. The study concludes that effectively incorporating Secure-DevOps practices throughout the Software developmental process, minimizes security risks and vulnerabilities.

Security and Privacy Challenges in Software as a Service (SaaS)

This document In the rapidly evolving landscape of cloud computing, Software as a Service (SaaS) has emerged as a dominant model for delivering software applications over the internet. However, this model introduces significant security and privacy challenges. This research paper delves into these issues, highlighting the unique risks associated with SaaS platforms. The study explores common vulnerabilities such as data breaches, unauthorized access, data loss, and identity theft, which are exacerbated by the centralized nature of SaaS solutions where data is stored on remote servers managed by service providers. To address these challenges, the paper underscores the importance of robust security measures, including encryption, access controls, and secure software development practices. Additionally, it emphasizes the necessity for SaaS providers to adopt advanced privacy protection techniques like data anonymization and differential privacy to meet user expectations and comply with stringent legal regulations such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). Through a comprehensive review of literature and analysis of current SaaS security practices, the research identifies critical risks and provides strategic recommendations for enhancing security and privacy in SaaS environments. By integrating multiple layers of security throughout the software development lifecycle, enforcing strict access management protocols, and ensuring compliance with regulatory standards, SaaS providers can significantly mitigate risks and safeguard sensitive user data. The findings of this study highlight the imperative for continuous improvement in SaaS security strategies to keep pace with emerging threats and technological advancements. Ultimately, by prioritizing security and privacy, SaaS providers can not only protect their users but also gain a competitive edge in the increasingly crowded market of cloud services.

Resilient cloud cluster with DevSecOps security model, automates a data analysis, vulnerability search and risk calculation

Automated, secure software development is an important digitalization task, solved with the DevSecOps approach. An important part of the DevSecOps approach is continuous risk assessment, which is necessary to identify and evaluate risk factors. Combining the development cycle with continuous risk assessment creates software development and operation synergies and minimizes vulnerabilities. The article presents the main methods of deploying web applications and ways to increase information security at all stages of product development. It also compares different types of infrastructures and cloud computing providers and analyzes modern tools used to automate processes. The cloud cluster was deployed using Terraform and the Jenkins pipeline, written in the Groovy programming language, which checks program code for vulnerabilities and allows you to fix violations at the earliest stages of developing secure web applications. The developed cluster implements the proposed algorithm for automated risk assessment based on the calculation (modeling) of cloud infrastructure threats and vulnerabilities, which operates in real-time, periodically collecting all information and adjusting the system according to the risk and applied controls. The algorithm for calculating risk and losses is based on statistical data and FAIR information risk assessment methodology. The risk value obtained using the proposed method is quantitative, which allows more efficient forecasting of information security costs in software development.

Human Aspects and Security in Software Development

Human Aspects and Security in Software Development

Constraints that Hinders Secure Software Implementation and Development Processes

Abstract: Internet of a things have change the entire world in the 21st century, software applications and system are now becoming part of human endeavour. The widely reliance software system is now an issue of concern, because almost everything aspect of human existences dwelled on it. Considering such intimacy and it used in storing of sensitive information and data in almost domain used by human, the need to come up with strategies that will overcome factors affecting implementation of secure software development process has become paramount important. However, most research stress building a secured software but with limited emphasis on the challenges that lead to poor implementation of secure software development process. The paper aims at evaluating the constraints that hinders secure software implementation and development process. Forty-five studies were reviewed using the Systematic literature review and concluded thirteen (13) factors affects successful implementation of secure software development practice.

Безопасный конвейер доставки программного обеспечения

The presence of vulnerabilities in software is a pressing problem. Vulnerabilities can serve as a basis for breach of confidentiality and information leakage. The purpose of this study is to increase the level of software security at all stages of the life cycle from development and implementation to operation. Achieving this goal is possible through automated analysis of program code and increasing the types of vulnerabilities detected. The work proposes a secure software delivery pipeline that allows for static and dynamic analysis of program code, analysis of the search for vulnerabilities in third-party components and Docker images. The article reviewed popular software tools, their distinctive features, and provided justification for the choice of software solutions that form the basis of the developed secure delivery pipeline. The novelty of the work is the ability of the pipeline to automatically detect vulnerabilities at all stages of the software life cycle, from planning and design to testing, deployment and monitoring in a production environment, which allows you to eliminate vulnerabilities at an early stage, thereby increasing the level of software security. Conducted testing and approbation of a secure software delivery pipeline. Based on the assessment results, the developed secure software delivery pipeline showed that on average 98% of vulnerabilities were identified using the Semgrep tool, 90% of vulnerabilities using the OWASP ZAP tool, 96% of vulnerabilities using the Dependency-Track tool, and 88% using the Trivy tool. The results of the study and experimental data showed that on average, as a result of testing, the accuracy of detecting vulnerabilities is 93%. The practical value of the work lies in the fact that the developed secure software delivery pipeline can be used as a tool for detecting program code vulnerabilities by software development specialists, as well as information security specialists of IT companies. The results obtained can be used in the field of secure software development, formalization and interpretation of vulnerabilities in program code, which will make it possible to create new rules for their identification and development of countermeasures to neutralize them.

Directions for strengthening the protection of software processing state electronic information resources and used at critical infrastructure facilities

In the modern world, where more and more aspects of our lives become dependent on computer systems and networks, cybersecurity becomes increasingly critical. One of the key elements of cybersecurity is protecting the software used in these systems. Software can contain vulnerabilities that attackers can exploit to gain unauthorized access to systems, data, and resources. These vulnerabilities may arise from coding errors, improper configurations, or inadequate software updates. Attackers continuously refine their methods and tactics not only to exploit software vulnerabilities but also to influence their emergence by targeting the supply chain. This makes software cybersecurity an increasingly complex challenge. This article addresses the pressing issue of cybersecurity in the context of the proliferation of cyberattacks on software, including supply chain attacks. Examples of known cyberattacks targeting the supply chain are provided. The shortcomings in the existing system of standards and rules for secure software development are highlighted, as well as the lack of security requirements and vulnerability management. A comprehensive approach to ensuring software security is proposed, which includes the development of appropriate requirements, standards, and control mechanisms.

Strategies for protecting IT supply chains against cybersecurity threats

This review paper explores the multifaceted realm of cybersecurity within IT supply chains, addressing the intricate challenges posed by digital vulnerabilities, high-profile cyber incidents, and emerging threats. It highlights the criticality of continuous risk assessment, the implementation of international security standards, and the necessity for enhanced management of third-party vendors. The paper also delves into advanced technological solutions like blockchain, AI, and machine learning for bolstering security, advocating for best practices including the zero-trust model, regular employee training, and secure software development. Emphasizing a proactive over a reactive approach, the paper underscores the evolving nature of cyber threats and the imperative for adaptive strategies. It calls for concerted efforts from businesses, policymakers, and IT professionals to prioritize and continuously refine cybersecurity measures in safeguarding IT supply chains against future threats. Keywords: IT Supply Chain, Cybersecurity, Risk Management, Blockchain, Zero-Trust Model, Artificial Intelligence.

Detecting and Patching Loopholes in Windows Operating System

Widely used in personal and business environments, the Windows operating system is a complex software platform that has historically been vulnerable to various intrusions and vulnerabilities. These breaches can be seen as software vulnerabilities, configuration vulnerabilities, higher validity issues, or architectural flaws, which can pose a serious security risk. This research report provides a comprehensive analysis of Windows vulnerabilities and examines their types, key examples such as EternalBlue and Stuxnet, and the potential impact they can have on individuals and organizations. This white paper examines mitigation strategies and best practices, including patch management, system hardening, vulnerability assessment, and the use of third-party security tools. It also addresses the challenges associated with blockchain, including the complexity of legacy code, zero-day vulnerabilities, targeted attacks, and the growing threat landscape. The paper also reviews future ideas, including secure software development practices, architectural improvements, collaboration and information sharing, automated vulnerability detection and remediation, and continuing education and security awareness. By taking a proactive approach to reducing intrusions, organizations can strengthen the security of their Windows systems, protect sensitive data, and maintain system integrity against threats and crimes.

Autonomous Vehicles: Evolution of Artificial Intelligence and the Current Industry Landscape

The advent of autonomous vehicles has heralded a transformative era in transportation, reshaping the landscape of mobility through cutting-edge technologies. Central to this evolution is the integration of artificial intelligence (AI), propelling vehicles into realms of unprecedented autonomy. Commencing with an overview of the current industry landscape with respect to Operational Design Domain (ODD), this paper delves into the fundamental role of AI in shaping the autonomous decision-making capabilities of vehicles. It elucidates the steps involved in the AI-powered development life cycle in vehicles, addressing various challenges such as safety, security, privacy, and ethical considerations in AI-driven software development for autonomous vehicles. The study presents statistical insights into the usage and types of AI algorithms over the years, showcasing the evolving research landscape within the automotive industry. Furthermore, the paper highlights the pivotal role of parameters in refining algorithms for both trucks and cars, facilitating vehicles to adapt, learn, and improve performance over time. It concludes by outlining different levels of autonomy, elucidating the nuanced usage of AI algorithms, and discussing the automation of key tasks and the software package size at each level. Overall, the paper provides a comprehensive analysis of the current industry landscape, focusing on several critical aspects.

Unlocking the Potential of AI/ML in DevSecOps: Effective Strategies and Optimal Practices

In the dynamic realm of technology, the fusion of Artificial Intelligence (AI) and Machine Learning (ML) with DevSecOps practices stands out as a pivotal catalyst for bolstering security, efficiency, and innovation in software development and deployment processes. This document explores effective strategies and optimal practices for maximizing the capabilities of AI/ML within the DevSecOps framework. Commencing with an overview of DevSecOps principles and the integral role of AI/ML, the document delves into specific tactics such as automated threat detection, predictive analytics for vulnerability management, and intelligent automation for continuous integration and deployment. Additionally, it addresses prominent challenges and considerations associated with the integration of AI/ML in DevSecOps, including data privacy, algorithm transparency, and ethical implications. Through illuminating case studies and real-world illustrations, the document showcases how organizations can leverage AI/ML technologies to streamline their DevSecOps pipelines, mitigate security risks, and cultivate a culture of ongoing enhancement. By embracing these strategies and adhering to best practices, organizations can harness the full potential of AI/ML to propel innovation, fortify resilience, and enhance agility in their DevSecOps endeavors.

Unlocking the Potential of AI/ML in DevSecOps: Effective Strategies and Optimal Practices

In the dynamic realm of technology, the fusion of Artificial Intelligence (AI) and Machine Learning (ML) with DevSecOps practices stands out as a pivotal catalyst for bolstering security, efficiency, and innovation in software development and deployment processes. This document explores effective strategies and optimal practices for maximizing the capabilities of AI/ML within the DevSecOps framework. Commencing with an overview of DevSecOps principles and the integral role of AI/ML, the document delves into specific tactics such as automated threat detection, predictive analytics for vulnerability management, and intelligent automation for continuous integration and deployment. Additionally, it addresses prominent challenges and considerations associated with the integration of AI/ML in DevSecOps, including data privacy, algorithm transparency, and ethical implications. Through illuminating case studies and real-world illustrations, the document showcases how organizations can leverage AI/ML technologies to streamline their DevSecOps pipelines, mitigate security risks, and cultivate a culture of ongoing enhancement. By embracing these strategies and adhering to best practices, organizations can harness the full potential of AI/ML to propel innovation, fortify resilience, and enhance agility in their DevSecOps endeavors.

LPMSAEF: Lightweight process mining-based software architecture evaluation framework for security and performance analysis

The article discusses the need for a lightweight software architecture evaluation framework that can address practitioners' concerns. Specifically, the proposed framework uses process mining and Petri nets to analyze security and performance in software development's early and late stages. Moreover, the framework has been implemented in six case studies, and the results show that it is a feasible and effective solution that can detect security and performance issues in complex and heterogeneous architecture with less time and effort. Furthermore, the article provides a detailed explanation of the framework's features, factors, and evaluation criteria. Additionally, this article discusses the challenges associated with traditional software architecture documentation methods using Unified Modeling Language diagrams and the limitations of code alone for creating comprehensive Software Architecture models. Various methods have been developed to extract implicit Software Architecture from code artifacts, but they tend to produce code-oriented diagrams instead of Software Architecture diagrams. Therefore, to bridge the model-code gap, the article proposes a framework that considers existing Software Architecture in the source code as architectural components and focuses on Software Architecture behaviors for analyzing performance and security. The proposed framework also suggests comparing Software Architecture extracted by different Process Mining algorithms to achieve consensus on architecture descriptions, using visualizations to understand differences and similarities. Finally, the article suggests that analyzing the previous version of a system's Software Architecture can lead to improvements and deviations from planned Software Architecture can be detected using traceability approaches to aid software architects in detecting inconsistencies.

Securing the smart city: A review of cybersecurity challenges and strategies

In the era of rapid urbanization and technological advancement, the emergence of smart cities promises innovative solutions to urban challenges. However, the integration of various technologies into urban infrastructures also exposes cities to unprecedented cybersecurity threats. This review presents a comprehensive review of the cybersecurity challenges faced by smart cities and explores the strategies to mitigate these risks. Smart cities leverage interconnected networks of sensors, devices, and systems to enhance efficiency, sustainability, and citizen services. Yet, this interconnectedness creates a complex attack surface vulnerable to cyber threats. One of the primary challenges is the diverse range of IoT devices deployed across smart city infrastructures, often lacking robust security mechanisms. These devices are susceptible to exploitation by cybercriminals for malicious activities, such as data breaches, sabotage, and surveillance. Moreover, the interconnected nature of smart city systems amplifies the potential impact of cyberattacks, posing significant risks to critical infrastructure, public safety, and privacy. Threat actors can exploit vulnerabilities in interconnected systems to disrupt essential services, manipulate data, or even cause physical harm. As smart cities rely on data-driven decision-making, the integrity and confidentiality of data become paramount concerns. To address these challenges, various cybersecurity strategies have been proposed and implemented. These strategies encompass a multi-layered approach, integrating technical solutions, regulatory frameworks, and collaboration among stakeholders. Technical measures include encryption, authentication mechanisms, intrusion detection systems, and secure software development practices. Additionally, implementing robust access controls and network segmentation can limit the scope of potential attacks. Furthermore, regulatory initiatives play a crucial role in enhancing cybersecurity standards and promoting compliance among smart city stakeholders. Establishing clear guidelines for data protection, privacy rights, and incident response protocols is essential to safeguarding citizens' interests. Collaboration among government agencies, private sector partners, academia, and cybersecurity experts fosters information sharing and collective defense against emerging threats. Securing smart cities against cybersecurity threats requires a concerted effort to address the multifaceted challenges posed by interconnected technologies. By implementing comprehensive strategies encompassing technical measures, regulatory frameworks, and collaborative approaches, smart cities can mitigate risks and foster a resilient and secure urban environment for all citizens.