Secure Software Development Process Research Articles

An Exploratory Study Gathering Security Requirements for the Software Development Process

Software development stands out as one of the most rapidly expanding markets due to its pivotal role in crafting applications across diverse sectors like healthcare, transportation, and finance. Nevertheless, the sphere of cybersecurity has also undergone substantial growth, underscoring the escalating significance of software security. Despite the existence of different secure development frameworks, the persistence of vulnerabilities or software errors remains, providing potential exploitation opportunities for malicious actors. One pivotal contributor to subpar security quality within software lies in the neglect of cybersecurity requirements during the initial phases of software development. In this context, the focal aim of this study is to analyze the importance of integrating security modeling by software developers into the elicitation processes facilitated through the utilization of abuse stories. To this end, the study endeavors to introduce a comprehensive and generic model for a secure software development process. This model inherently encompasses critical elements such as new technologies, human factors, and the management of security for the formulation of abuse stories and their integration within Agile methodological processes.

A Study On Software Engineering Defect Prediction

The success of any software system entirely depends on the accuracy of the results of the system and whether it is without any flaws. Software defect prediction problems have an extremely beneficial research potential. Software defects are the major issue in any software industry. Software defects not only reduce the software quality, increase costing but it also suspends the development schedule. Software bugs lead to inaccurate and discrepant results. As an outcome of this, the software projects run late, are cancelled or become unreliable after deployment. Quality and reliability are the major challenges faced in a secure software development process. There are major software cost overruns when a software product with bugs in its various components is deployed at client s side. The software warehouse is commonly used as record keeping repository which is mostly required while adding new features or fixing bugs. Many data mining techniques and dataset repository are available to predict the software defects. Bug prediction technique is an important part in software engineering area for last one decade. Software bugs which detect at early stage are simple and inexpensive for rectifying the software. Software quality can be enhanced by using the bug prediction techniques and the software bug can be reduced if applied accurately. Dependent and independent variable are considered in Software bug prediction. To prevent defect based on software metrics software prediction model are used. Metrics based classification categorize component as defective and non-defective.

A STUDY ON SOFTWARE DEFECT PREDICTION SYSTEM USING DATA MINING TECHNIQUES

Defects in software modules are a source of significant concern. Software reliability and software quality assurance ensure the high quality of applications. A software defect triggers software malfunction in an executable product. A number of methods for forecasting machine faults have been suggested, but none have proven to be sufficiently accurate. In the design of software error prediction models, the aim is to use metrics that can be obtained comparatively early in the life cycle of software production to provide fair initial quality estimates of an evolving software framework.Here are various data mining classification and forecasting techniques. Artificial Neural Network (ANN), K-Nearest Neighbor (KNN) have been analyzed and compared for software defect prediction model development. For this paper, the DATATRIEVETM project developed by Digital Engineering, Italy was used to validate the algorithm. The findings revealed that the model was an exceptional statistical model using the NN classification methodology. The main challenges faced in the secure software development process are quality and reliability. There are major software cost violations when a software product with errors in its various components is used on the customer’s side. The software warehouse is commonly used as a record keeping repository, which is often needed when adding new features or fixing bugs. Software errors can lead to erroneous and different results. As a result, software programs run late, are canceled, or become unreliable after use. Different social and technical issues are associated with software failure and software defects are the main reasons for deteriorating product quality. In software engineering, the most active research in software domain is defect prediction.This study discusses the bug-fix time forecast model, pre-release release, post-release error and different measurements to predict failures. Predicted results help developers identify and fix potential vulnerabilities, thereby improving software stability and reliability.

Time for Addressing Software Security Issues: Prediction Models and Impacting Factors

Finding and fixing software vulnerabilities have become a major struggle for most software development companies. While generally without alternative, such fixing efforts are a major cost factor, which is why companies have a vital interest in focusing their secure software development activities such that they obtain an optimal return on this investment. We investigate, in this paper, quantitatively the major factors that impact the time it takes to fix a given security issue based on data collected automatically within SAP’s secure development process, and we show how the issue fix time could be used to monitor the fixing process. We use three machine learning methods and evaluate their predictive power in predicting the time to fix issues. Interestingly, the models indicate that vulnerability type has less dominant impact on issue fix time than previously believed. The time it takes to fix an issue instead seems much more related to the component in which the potential vulnerability resides, the project related to the issue, the development groups that address the issue, and the closeness of the software release date. This indicates that the software structure, the fixing processes, and the development groups are the dominant factors that impact the time spent to address security issues. SAP can use the models to implement a continuous improvement of its secure software development process and to measure the impact of individual improvements. The development teams at SAP develop different types of software, adopt different internal development processes, use different programming languages and platforms, and are located in different cities and countries. Other organizations, may use the results—with precaution—and be learning organizations.

Developing Secure Systems: A Comparative Study of Existing Methodologies

With the increasing demand for developing high-quality and more reliable systems, the process of developing trustworthy computer software is a challenging one. In this paper, we review various approaches to producing more secure systems. This includes established general principles for designing secure systems. It also provides an introduction to general software quality measurements including existing software security metrics. This paper also includes a comparison of the various security metrics for developing secure systems (i.e., architectural, design, and code-level metrics). Lastly, the paper examines the approach of refactoring, illustrates its objectives, and shows how refactoring is generally used for enhancing the quality of existing programs from the perspective of information security. At the end of this paper, we provide a discussion of these three approaches and how they can be used to provide guidance for future secure software development processes.

Meta-Modeling Based Secure Software Development Processes

This work suggests a multilevel support to software developers, who often lack knowledge and skills on how to proceed to develop secure software. In fact, developing software with such quality is a hard and complex task that involves many additional security-dedicated activities which are usually omitted in traditional software development lifecycles or integrated but not efficiently and appropriately deployed in some others. To federate all these software security-assurance activities in a structured way and provide the required guidelines for choosing and using them in a flexible development process, authors used meta-modeling techniques and dynamic process execution that consider developer's affinities and product's states. The proposed approach formalizes existing secure software development processes, allows integration of new ones, prevents ad-hoc executions and is supported by a tool to facilitate its deployment. A case study is given here to exemplify the proposed approach application and to illustrate some of its advantages.

On the secure software development process: CLASP, SDL and Touchpoints compared

Development processes for software construction are common knowledge and mainstream practice in most development organizations. Unfortunately, these processes offer little support in order to meet security requirements. Over the years, research efforts have been invested in specific methodologies and techniques for secure software engineering, yet dedicated processes have been proposed only recently. In this paper, three high-profile processes for the development of secure software, namely OWASP’s CLASP, Microsoft’s SDL and McGraw’s Touchpoints, are evaluated and compared in detail. The paper identifies the commonalities, discusses the specificity of each approach, and proposes suggestions for improvement.