Secure Application Development Research Articles

From Code to Care: The Impact of Software Engineering and QA on Healthcare Delivery Systems

The rapid digitalization of healthcare has led to an unprecedented reliance on software systems to improve patient care, streamline operations, and ensure regulatory compliance. This article presents a comprehensive analysis of the critical role that software engineering and quality assurance (QA) play in three key areas of modern healthcare: Electronic Health Records (EHRs), telemedicine platforms, and medical device software. Through an examination of current practices, challenges, and case studies, we demonstrate how robust software engineering methodologies and rigorous QA processes contribute to the development of reliable, secure, and efficient healthcare applications. Our findings highlight the importance of data integrity, interoperability, user experience, and regulatory compliance in healthcare software development. Furthermore, we explore emerging trends such as artificial intelligence, blockchain, and the Internet of Medical Things (IoMT), discussing their implications for future software engineering and QA practices in healthcare. This article provides valuable insights for healthcare organizations, software developers, and policymakers, offering recommendations to enhance the quality and safety of software-driven healthcare solutions.

Expediting the design and development of secure cloud-based mobile apps

The adoption and popularity of mobile devices by end-users is partially driven by the increasing development and availability of mobile applications that can aid solving different problems and provide access to services in a wide range of domains or categories, namely healthcare, education, e-commerce or entertainment. While these applications use and benefit from the combination of a wide panoply of technologies from the Internet of Things, fog and cloud computing, data security and privacy are typically not fully taken into account before the creation of many mobile applications or during the software development phases. This paper presents an in-depth approach to modeling attacks on the specific cloud and mobile ecosystem, given its importance in the process of secure application development. Moreover, aiming at bridging the knowledge gap between developers and security experts, this paper presents an alpha version of the security by design for cloud and mobile ecosystem (secD4CloudMobile) framework. secD4CloudMobile is a set of tools that covers cloud and mobile security requirement elicitation (CMSRE), cloud and mobile security best practices guidelines (CMSBPG), cloud mobile attack modeling elicitation (CMAME), and cloud mobile security test specification and tools (CM2ST). The purpose of the framework is to provide cloud and mobile application developers useful readily applicable information and guidelines, striving to bring security engineering and software engineering closer, in a more accessible and automated manner, aiming at the incorporation of security by construction. Finally, the paper presents some preliminary results and discussion.

Carbon-based nanomaterials cause toxicity by oxidative stress to the liver and brain in Sprague–Dawley rats

Carbon-based nanomaterials have important research significance in various disciplines, such as composite materials, nanoelectronic devices, biosensors, biological imaging, and drug delivery. Recently, the human and ecological risks associated with carbon-based nanomaterials have received increasing attention. However, the biological safety of carbon based nanomaterials has not been systematically studied. In this study, we used different types of carbon materials, namely, graphene oxide (GO), single-walled carbon nanotubes (SWCNTs), and multiwalled carbon nanotubes (MWCNTs), as models to observe their distribution and oxidative damage in vivo. The results of Histopathological and ultrastructural examinations indicated that the liver and lungs were the main accumulation targets of these nanomaterials. SR-μ\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\\upmu$$\\end{document}-XRF analysis revealed that SWCNTs and MWCNTs might be present in the brain. This shows that the three types of carbon-based nanomaterials could cross the gas–blood barrier and eventually reach the liver tissue. In addition, SWCNTs and MWCNTs could cross the blood–brain barrier and accumulate in the cerebral cortex. The increase in ROS and MDA levels and the decrease in GSH, SOD, and CAT levels indicated that the three types of nanomaterials might cause oxidative stress in the liver. This suggests that direct instillation of these carbon-based nanomaterials into rats could induce ROS generation. In addition, iron (Fe) contaminants in these nanomaterials were a definite source of free radicals. However, these nanomaterials did not cause obvious damage to the rat brain tissue. The deposition of selenoprotein in the rat brain was found to be related to oxidative stress and Fe deficiency. This information may support the development of secure and reasonable applications of the studied carbon-based nanomaterials.

Secure Agent-Oriented Modelling with Web-based Security Application Development

Nowadays, privacy and security have become challenges in developing web-based applications. For example, e-commerce applications are threatened with security issues like scammers, SQL injection attacks, bots, DDOs, Server Security, and Phishing. Although various security requirement methodologies are introduced, it has been reported that security consideration is consistently ignored or treated as the lowest priority during the application development process. Hence, the application is being violated by various security attacks. This paper introduces an alternative methodology to secure a web-based application through an Agent-Oriented Modelling extension. The secure AOM starts with Context and Asset Identification. The models involved in this phase are the Goal Model and Secure Tropos model. The second phase is the Determination of Security Objective. The model that will be used is Secure Tropos. The third phase is Risk Analysis and Assessment. The model that will be used is Secure Tropos. The fourth phase is Risk Treatment. In this phase, there is no model, but we use the suggestion from Secure Tropos: to eliminate risk, transfer risk, retain risk, and reduce risk. The fifth phase is Security Requirements Definition. The models that will be used are the scenario model, interaction model, and knowledge model. The last phase is Control Selection and Implementation. The model that will be used is the Behavior Model. We conducted a reliability analysis to analyze the participants' understanding of Secure AOM. From the reliability test, we can conclude that Secure AOM can become the alternative methodology, as the percentage that agrees that Secure AOM can protect users against making errors and mistakes is 80.9%, and 71.9% agree that SAOM can help to prevent users from specifying incorrect model elements and the relation between the model. This result means that over 50% of the participants agree that Secure AOM can be an alternative methodology that supports security risk management.

AI기반 보안산업의 육성과제

Recently, the government's interest in industries utilizing AI has been amplified, with initiatives such as announcing a roadmap aiming to achieve the goal of becoming the world's fifth largest information security industry by 2027, with a market size of 30 trillion won, driven by digitalization and expansion in the security domain. AI represents a paradigm shift demanding innovation across nations, societies, and industries, necessitating proactive preparation and response. In the security sector, the paradigm is shifting from traditional human security to integrated security, convergence security, and AI security. To establish a foothold in the global security market, it is imperative to apply new security systems tailored to the Fourth Industrial Revolution through technological innovation, foster convergence security and physical security industries. Therefore, this study aims to propose the nurturing and development direction of the security industry based on AI, which is the core technology of the Fourth Industrial Revolution, as society evolves into a hyper-intelligent, hyper-connected, and hyper-convergent society. To foster the AI-based security industry, the application and operation of AI-based security systems need to be expanded across the entire security business. These include applying AI virtual security guards, AI-based security robots, AI-based drones, AI-based intelligent video monitoring in security rooms, AI-based autonomous driving technology and smart parking solutions, AI-based security systems in personal protection tasks, AI-based on-site crowd management systems, AI-based IoT integrated security systems, and operation of AI-based machine security systems that can be applied to the six security tasks regulated by security laws and regulations. From a policy perspective, policy support for creating new jobs and ensuring stable employment in AI security-related fields should follow. At the national level, there should be policies to nurture and support the AI-based security industry, along with efforts to address ethical issues related to AI. Furthermore, new education programs related to the Fourth Industrial Revolution and AI need to be introduced according to security laws and regulations. From a technological and academic perspective, it is necessary to enhance the professionalism of security companies to actively respond to the Fourth Industrial Revolution, and continuous development of AI-related security technologies is essential. Academic research should continue, focusing on in-depth research and development of AI security applications in various security sectors.

RESEARCH OF CYBER SECURITY TECHNOLOGIES OF CLOUD SERVICES IAAS, PAAS AND SAAS

Cybersecurity threats are constantly evolving, and cloud computing is no exception. Attackers are improving attack techniques aimed at identifying vulnerabilities in IaaS, PaaS, and SaaS. The work examines the following problematic issues: insufficient analytical tools; data privacy and security; financial and organizational costs to ensure cyber security of IaaS, PaaS and SaaS cloud technologies. The aim of the work is to investigate how the common models of cloud computing: infrastructure as a service (IaaS), platform as a service (PaaS) and software as a service (SaaS) need to properly implement adequate and appropriate protection measures to ensure cyber security. For this purpose, the paper examined models of cloud technologies, it was determined that cloud services include various models that allow users to access various types of resources via the Internet. It has been found that there are three generally accepted models of cloud services: infrastructure as a service (IaaS), platform as a service (PaaS) and software as a service (SaaS), and two main players: the cloud provider and the cloud subscriber. The set of levels over which each of these players has control depends on the model of the cloud service or environment. For each of these cloud services, its description was given, recommendations were given for access control, privacy assurance, terms of use were defined, advantages and disadvantages were given, and market trends of these services were considered. Proposed approaches to the formation of a secure application development environment in cloud services. Features such as wide network access, resource pooling, fast elasticity, service metering, and data sharing are also summarized. Guidelines for designing access control for IaaS, PaaS, and SaaS according to their different characteristics are proposed. In addition, the security policy rules for each cloud system are summarized. Technologies are proposed to protect security at each of the three main layers of cloud services: the application, middleware, and virtual machine layers, due to differences in the organization that controls each of these layers. It was found that for any level it is possible to provide more effective protection if the same subject controls the level below. Since the network, hardware, and resource abstraction layer in all cloud service models are controlled by the cloud provider, it has more effective protections at its disposal.

Comprehensive Analysis of Blockchain Algorithms

INTRODUCTION: Blockchain technology has gained significant attention across various sectors as a distributed ledger solution. To comprehend its applicability and potential, a comprehensive understanding of blockchain's essential elements, functional traits, and architectural design is imperative. Consensus algorithms play a critical role in ensuring the proper operation and security of blockchain networks. Consensus algorithms play a vital role in maintaining the proper operation of a blockchain network, and their selection is crucial for optimal performance and security.
 OBJECTIVES: The objective of this research is to analyse and compare various consensus algorithms based on their performance and efficiency in mining blocks.
 METHODS: To achieve this, an experimental model was developed to measure the number of mined blocks over time for different consensus algorithms.
 RESULTS: The results provide valuable insights into the effectiveness and scalability of these algorithms. The findings of this study contribute to the understanding of consensus algorithm selection and its impact on the overall performance of blockchain systems.
 CONCLUSION: The findings of this study contribute to the understanding of consensus algorithm selection and its impact on the overall performance of blockchain systems. By enhancing our knowledge of consensus algorithms, this research aims to facilitate the development of more secure and efficient blockchain applications.

Security Automation in Application Development Using Robotic Process Automation (RPA)

In the contemporary digital landscape, the rapid advancement of application development necessitates a parallel evolution in security measures. Traditional security practices often struggle to keep pace with the dynamic nature of modern software development. To address these challenges, Robotic Process Automation (RPA) emerges as a transformative tool, offering substantial potential to automate security tasks within the application development lifecycle. This paper explores the integration of RPA into security automation, focusing on its capabilities to enhance security protocols, minimize human error, and streamline processes across various stages of development. Security automation through RPA involves the deployment of software robots to perform repetitive, rule-based tasks that are essential to maintaining and enforcing security standards. These tasks include automated code scanning, vulnerability assessments, compliance checks, and incident response, all of which are crucial to the development and deployment of secure applications. By automating these processes, organizations can significantly reduce the time and resources required to secure applications, ensuring that security measures are not compromised by the speed and agility demanded by modern development practices.

Blockchain-Enhanced Smart Contract for Cost-Effective Insurance Claims Processing

Blockchain-enabled smart contracts have revolutionized the insurance industry due to their potential to streamline backend operations, mitigate fraudulent claims, and enhance data security and transparency. Guided by the design science methodology, the authors propose two specific smart contract frameworks to enhance insurance claims processing related to vehicle damage claims and personal injury claims. These proposed frameworks can improve the overall efficiency and effectiveness of insurance claims processing by automating claims submission, review, analysis, and payment, while reducing fraud and data leakage, by merging various data sources and disintermediation. Furthermore, the authors design a smart contract template supported by eight operational algorithms to facilitate the processing of insurance claims with the help of smart contracts. This template provides practitioners with a standardized prototype for the development of secure and efficient insurance applications.

Hardware/Software Co-Assurance for the Rust Programming Language Applied to Zero Trust Architecture Development

Zero Trust Architecture requirements are of increasing importance in critical systems development. Zero trust tenets hold that no implicit trust be granted to assets based on their physical or network location. Zero Trust development focuses on authentication, authorization, and shrinking implicit trust zones to the most granular level possible, while maintaining availability and minimizing authentication latency. Performant, high-assurance cryptographic primitives are thus central to successfully realizing a Zero Trust Architecture. The Rust programming language has garnered significant interest and use as a modern, type-safe, memory-safe, and potentially formally analyzable programming language. Our interest in Rust particularly stems from its potential as a hardware/software co-assurance language for developing Zero Trust Architectures. We describe a novel environment enabling Rust to be used as a High-Level Synthesis (HLS) language, suitable for secure and performant Zero Trust application development. Many incumbent HLS languages are a subset of C, and inherit many of the well-known security shortcomings of that language. A Rust-based HLS brings a single modern, type-safe, memory-safe, high-assurance development language for both hardware and software. To study the benefits of this approach, we crafted a Rust HLS subset, and developed a frontend to the hardware/software co-assurance toolchain due to Russinoff and colleagues at Arm, used primarily for floating-point hardware formal verification. This allows us to leverage a number of existing hardware/software co-assurance tools with a minimum investment of time and effort. In this paper, we describe our Rust subset, detail our prototype toolchain, and describe the implementation, performance analysis, formal verification and validation of representative Zero Trust algorithms and data structures written in Rust, emphasizing cryptographic primitives and common data structures.

Comprehensive physics-based RRAM compact model including the effect of variability and multi-level random telegraph noise

Resistive Random Access Memory (RRAM) technologies are a promising candidate for the development of more energy efficient circuits, for computing, security, and storage applications. However, such devices show stochastic behaviours that not only originate from variations introduced during fabrication, but that are intrinsic to their operation. Specifically, cycle-to-cycle variations cause the programmed resistive state to be randomly distributed, while Random Telegraph Noise (RTN) introduces random current fluctuations over time. These phenomena can easily affect the reliability and performance of RRAM-based circuits. Therefore, designing such circuits requires accurate compact models. Although several RRAM compact models have been proposed in the literature, these are rarely implemented following the programming best-practice for improving the simulator convergence, and a compact model that is able to reproduce the device characteristic including thermal effects, RTN, and variability in multiple operating conditions using a single set of parameters is still missing. Also, only a few works in the literature describe the procedure to calibrate such compact models, and even fewer address the calibration of the variability on experimental data. In this work, we extend the UniMORE RRAM physics-based compact model by developing and validating two variability models, (i) a comprehensive variability model which can reproduce the effect of cycle-to-cycle variability in multiple operating conditions, and (ii) a simplified version that requires fewer calibration data and enables to reproduce cycle-to-cycle variations in specific operating conditions. The model is implemented following Verilog-A programming best-practices and validated on data from three RRAM technologies from the literature and experimentally on TiN/Ti/HfOx/TiN devices, and the relation between experimental data and the variability model parameters is described.

Reconciling optimization with secure compilation

Software protections against side-channel and physical attacks are essential to the development of secure applications. Such protections are meaningful at machine code or micro-architectural level, but they typically do not carry observable semantics at source level. This renders them susceptible to miscompilation, and security engineers embed input/output side-effects to prevent optimizing compilers from altering them. Yet these side-effects are error-prone and compiler-dependent. The current practice involves analyzing the generated machine code to make sure security or privacy properties are still enforced. These side-effects may also be too expensive in fine-grained protections such as control-flow integrity. We introduce observations of the program state that are intrinsic to the correct execution of security protections, along with means to specify and preserve observations across the compilation flow. Such observations complement the input/output semantics-preservation contract of compilers. We introduce an opacification mechanism to preserve and enforce a partial ordering of observations. This approach is compatible with a production compiler and does not incur any modification to its optimization passes. We validate the effectiveness and performance of our approach on a range of benchmarks, expressing the secure compilation of these applications in terms of observations to be made at specific program points.

A fuzzy TOPSIS based analysis toward selection of effective security requirements engineering approach for trustworthy healthcare software development

BackgroundToday’s healthcare organizations want to implement secure and quality healthcare software as cyber-security is a significant risk factor for healthcare data. Considering security requirements during trustworthy healthcare software development process is an essential part of the quality software development. There are several Security Requirements Engineering (SRE) methodologies, framework, process, standards available today. Unfortunately, there is still a necessity to improve these security requirements engineering approaches. Determining the most suitable security requirements engineering method for trustworthy healthcare software development is a challenging process. This study is aimed to present security experts’ perspective on the relative importance of the criteria for selecting effective SRE method by utilizing the multi-criteria decision making methods.MethodsThe study was planned and conducted to identify the most appropriate SRE approach for quality and trustworthy software development based on the security expert’s knowledge and experience. The hierarchical model was evaluated by using fuzzy TOPSIS model. Effective SRE selection criteria were compared in pairs. 25 security experts were asked to response the pairwise criteria comparison form.ResultsThe impact of the recognized selection criteria for effective security requirements engineering approaches has been evaluated quantitatively. For each of the 25 participants, comparison matrixes were formed based on the scores of their responses in the form. The consistency ratios (CR) were found to be smaller than 10% (CR = 9.1% < 10%). According to pairwise comparisons result; with a 0.842 closeness coefficient (Ci), STORE methodology is the most effective security requirements engineering approach for trustworthy healthcare software development.ConclusionsThe findings of this research study demonstrate various factors in the decision-making process for the selection of a reliable method for security requirements engineering. This is a significant study that uses multi-criteria decision-making tools, specifically fuzzy TOPSIS, which used to evaluate different SRE methods for secure and trustworthy healthcare application development.

Airdrop 2.0 Vulnerability Detection System

In the world of today cyber security has become of upmost importance, it provides a means for protecting vital information that is uploaded to the internet. A vulnerability detection system seeks to detect possible exploits in systems that can be used to harm or steal information. On mobile platforms security is also an issue and various means have been created to combat these security flaws. One of the commonest vulnerabilities know in the world is that of the Denial of Service (DoS) attack, even though they are many ways in which this can be conquered there is no true solution that may work for every platform .This study focuses on the effect of Denial of Service attack on a mobile platform, along with a viable and easily deployable solution. This will give researchers an insight into the security threats that mobile platforms have and also give a solution to be built upon for development of secure applications in the future. Keywords: Denial of Service, Detection System, Vulnerabilities, Mobile platform. DOI: 10.7176/NCS/11-03 Publication date: July 31st 2020

Vulnerabilities Mapping based on OWASP-SANS: A Survey for Static Application Security Testing (SAST)

The delivery of a framework in place for secure application development is of real value for application development teams to integrate security into their development life cycle, especially when a mobile or web application moves past the scanning stage and focuses increasingly on the remediation or mitigation phase based on static application security testing (SAST). For the first time, to the author’s knowledge, the industry-standard Open Web Application Security Project (OWASP) top 10 vulnerabilities and CWE/SANS top 25 most dangerous software errors are synced up in a matrix with Checkmarx vulnerability queries, producing an application security framework that helps development teams review and address code vulnerabilities, minimise false positives discovered in static scans and penetration tests, targeting an increased accuracy of the findings. A case study is conducted for vulnerabilities scanning of a proof-of-concept mobile malware detection app. Mapping the OWASP/SANS with Checkmarx vulnerabilities queries, flaws and vulnerabilities are demonstrated to be mitigated with improved efficiency.

Development and Performance Evaluation of a Connected Vehicle Application Development Platform

Connected vehicle (CV) application developers need a development platform to build, test, and debug real-world CV applications, such as safety, mobility, and environmental applications, in edge-centric cyber-physical system (CPS). The objective of this paper is to develop and evaluate a scalable and secure CV application development platform (CVDeP) that enables application developers to build, test, and debug CV applications in real-time while meeting the functional requirements of any CV applications. The efficacy of the CVDeP was evaluated using two types of CV applications (one safety and one mobility application) and they were validated through field experiments at the South Carolina Connected Vehicle Testbed (SC-CVT). The analyses show that the CVDeP satisfies the functional requirements in relation to latency and throughput of the selected CV applications while maintaining the scalability and security of the platform and applications.

Attack and System Modeling Applied to IoT, Cloud, and Mobile Ecosystems

Over the years, pervasive computing and communication technologies have enabled the emergence of new computing paradigms that have gained importance across a wide spectrum of domains. The three most notable that have witnessed significant advancements and have a solid track record of exponential growth in diverse applications are the Internet of Things (IoT), Cloud, and Mobile Computing. The ubiquity of these paradigms, their expandability, and applicability in different problem spaces have made them invaluable in modern computing solutions. Security becomes a real concern, especially when it comes to the development of applications in these environments, as numerous security issues may arise from potential design flaws. Secure application development across these three technologies can only be achieved when applications and systems are designed and developed with security in mind. This will improve the quality of the solutions and ensure that vulnerabilities are identified. It will also help in defining countermeasures against cyberattacks or mitigate the effects of potential threats to the systems. This article surveys existing approaches, tools, and techniques for attack and system modeling applicable to IoT, Cloud computing, and Mobile Computing. It also evaluates the strengths and limitations of the reviewed approaches and tools, from which it highlights the main existing challenges and open issues in the area.

A Knowledge-Based Integrated System of Hesitant Fuzzy Set, AHP and TOPSIS for Evaluating Security-Durability of Web Applications

There has been a phenomenal increase in the use of web applications in every facet of human endeavor. From education, healthcare, banking, business to governance and so much more now depends on secure web applications. This accelerated growth in the use of web applications has led to increase in the complexity of security and hence the present day developers have to contribute more significantly towards meeting the users' requirements. However, the high security of web application is not yet efficacious enough because the durability of web application is not as much as it should be. In this context, it is important to consider that ensuring sustainability of security at the early stage of web application development process may reduce costs and rework entailed during the development of secure and durable web applications. Hence, there is a need to focus on increasing the life-span of a secure web application. Quantitative estimation of security-durability plays a significant role for improving the life-span of a secure web application. Thus, to optimize the security assurance effort for a specific life-span, this paper is aimed at estimating the security-durability of web application. For estimating security-durability, this paper uses a hybrid approach of Hesitant Fuzzy (HF) sets, Analytic Hierarchy Process (AHP) and Technique for Order of Preference by Similarity to Ideal Solution (TOPSIS) techniques. The effectiveness of the combined approach of HF-AHP-TOPSIS is tested for its accuracy in a web application for an academic institution, Babasaheb Bhimrao Ambedkar University in India. To check the sensitivity of outcomes, authors of the paper have taken altered forms of the University's web application. The result established contains the security-durability assessment. This work seeks to be an important contribution in enhancing the security-durability and would be beneficial for experts who are working in this domain.

Towards a framework for online information security applications development: A socio-technical approach

The paper presents a validated socio-technical information security (STInfoSec) framework for the development of online information security (InfoSec) applications. The framework addresses both social and technical aspects of InfoSec design. The preliminary framework was developed using a mixed methods research design that collected data from 540 surveys by online banking users and six interviews with online banking personnel. The preliminary framework was presented in another publication and it is beyond the scope of this paper. The scope of this paper is limited to the validation findings of the evaluation process that involves seven evaluators. In the socio-technical context, the STInfoSec framework facilitates acceptance and usability of online applications based on online banking as a case study. The authors argue that usability of online InfoSec applications such as online banking significantly affects the adoption and continued use of such applications. As such, the paper investigates design principles for usable security and proposes a validated STInfoSec framework that consists of 12 usable security design principles. The design principles have been validated through heuristic evaluation by seven field experts for inclusion in the final STInfoSec framework. The development of InfoSec applications can be improved by applying these design principles.

Automatic Enhancement Of Digital Images Using Cubic Bézier Curve And Fourier Transformation

Image enhancement is one of the most important and visually appealing areas of digital image processing and computer vision. It is considered as a very important part of pre-processing for the development of industrial, security, forensic, medical, and many other applications. Although significant efforts were devoted in the past, a completely automatic image enhancement for all types of input and applications is still a big challenge in the domain of image processing. In this paper, we have proposed a multi-disciplinary approach to enhance the image automatically by intensity transformation in the spatial domain through cubic BA©zier curve on images filtered with low and high pass Butterworth in the frequency domain. Results are promising when compared with the existing state-of-the-arts techniques for both visually and quantitatively, which proved that the proposed method can ensure better contrast enhancement.