Software Security Risk Research Articles

Calculation and Comparative Analysis of Common Fault Scores for Secure Computers Based on Embedded Neural Networks

With the rapid development of computer networks and information technology, government departments, financial institutions, and enterprises are increasingly dependent on software, and software security issues have become a focus of attention. In this context, how to effectively evaluate the security of software has become an important issue for research institutions both domestically and internationally. On the basis of exploring software definition, this paper not only analyzes the security and potential threats of software in computer networks, but also introduces Embedded Neural Networks (ENNs) as an evaluation tool, and combines Fuzzy Analytic Hierarchy Process (FAHP) to deeply explore a new method for software security risk assessment. By utilizing the powerful pattern recognition capability of ENNs, software logs, system call sequences, and other data can be classified and analyzed to distinguish between normal and abnormal behavior. This ability is crucial for identifying security incidents such as malicious software and unauthorized access. ENNs are designed with resource constraints in mind, which can reduce energy consumption while ensuring performance. For software systems that require long-term operation, this means higher security and stability. Practice has proven that combining ENNs with FAHP can more scientifically and effectively evaluate software security. This method not only improves the accuracy and efficiency of evaluation, but also provides a more solid theoretical foundation and technical support for software security protection.

Evaluation and Assessment of Software Security Risks and Vulnerabilities Within the Realm of Secure DevOps.

Security plays a vital role in successful software development and consistency, especially in a modern, fast-expanding world dominated by technologies. It guarantees that all privacy, integrity, and accessibility of information, coding, and services are protected. Achieving such requires a consistent consideration of security throughout all developmental stages of software. Although several methods for improving the quality of software have been created, there is still no clear method for effectively integrating security throughout each stage of the software developmental process. The inability to give adequate attention to security has been identified as the main cause of common flaws. Many forward-thinking businesses frequently employ a "patch and infiltrate” technique, taking security into consideration only after the execution of the task. Higher costs, project delays, neglect of verification and integration during the development life cycle of the project, reliance on external tools and parts, and ignorance among all factors contribute to the disregard of security during the SDLC. Nevertheless, Secure-DevOps is indispensable for the survival of companies in the Information and Communication Technology (ICT) landscape. Consequently, applying an effective approach that deals with security within every level of the SDLC is crucial. To bridge this gap, a comprehensive examination of effective techniques for developing secure software was presented, taking into account the financial and time constraints of a project. A framework for ensuring security built upon Secure-DevOps practices, which seamlessly integrates the best security measures into different stages of the SDLC, was identified. To validate this framework, a mathematical model has been employed. The study concludes that effectively incorporating Secure-DevOps practices throughout the Software developmental process, minimizes security risks and vulnerabilities.

Revisit security in the era of DevOps: An evidence‐based inquiry into DevSecOps industry

AbstractBy adopting agile and lean practices, DevOps aims to achieve rapid value delivery by speeding up development and deployment cycles, which however lead to more security concerns that cannot be fully addressed by an isolated security role only in the final stage of development. DevSecOps promotes security as a shared responsibility integrated into the DevOps process that seamlessly intertwines development, operations, and security from the start throughout to the end of cycles. While some companies have already begun to embrace this new strategy, both industry and academia are still seeking a common understanding of the DevSecOps movement. The goal of this study is to report the state‐of‐the‐practice of DevSecOps, including the impact of DevOps on security, practitioners' understanding of DevSecOps, and the practices associated with DevSecOps as well as the challenges of implementing DevSecOps. The authors used a mixed‐methods approach for this research. The authors carried out a grey literature review on DevSecOps, and surveyed the practitioners of DevSecOps in industry of China. The status quo of DevSecOps in industry is summarized. Three major software security risks are identified with DevOps, where the establishment of DevOps pipeline provides opportunities for security‐related activities. The authors classify the interpretations of DevSecOps into three core aspects of DevSecOps capabilities, cultural enablers, and technological enablers. To materialise the interpretations into daily software production activities, the recommended DevSecOps practices from three perspectives—people, process, and technology. Although a preliminary consensus is that DevSecOps is regarded as an extension of DevOps, there is a debate on whether DevSecOps is a superfluous term. While DevSecOps is attracting an increasing attention by industry, it is still in its infancy and more effort needs to be invested to promote it in both research and industry communities.

Security risks of global software development life cycle: Industry practitioner's perspective

AbstractSoftware security has become increasingly important because the malicious attack and other hacker risks of a computer system have grown popularity in the last few years. As a result, several researchers have examined security solutions as early as the requirement engineering phase. With the growth of the software business and the internet, there is a need to understand the security risks against each phase of the software development life cycle (SDLC). This study aims to empirically investigate and prioritize the risks that could negatively impact the software security aspects of SDLC in the context of global software development (GSD). To achieve the study objectives, we conducted an industrial empirical study to determine the impact of software security threats against each phase of SDLC. Furthermore, the fuzzy analytical hierarchy process (FAHP) was used to prioritize the list of software security risks against the SDLC. The results and analysis of this study provide a ranked‐based decision‐making framework, which assists the practitioners in considering the most critical security risks on priority. The results show “improper plan for secure requirement identification, inception, authentication, authorization, and privacy,” “lack of threat models updating,” “lack of output validation,” “lack of certification in the final release and archive,” and “spoofing” as the top‐ranked security risks of SDLC in GSD. In addition, the application of FAHP is novel in this domain as it is helpful to address multicriteria decision‐making problems.

Buffer Overflow Vulnerabilities and Prevention

Either in terms of software error or being an attack itself, buffer overflow attacks have been one of the most important security problems accountable for a common vulnerability of software security and cyber risks. Buffer overflow vulnerabilities influence the zone of remote network penetration vulnerabilities, where an anonymous user tries to gain partial or complete control of the host. Buffer overflow attacks liable for some of the biggest data breaches in recent years. One of the notable data breach examples include Morris worm or internet worm of November 2, 1988. Morris worm is an ancient computer worm distributed via the internet, was noted for infecting around 6000 major Unix machines. This paper mainly focuses on buffer overflow attack vulnerabilities and the preventive measures to safeguard once system from being attacked. Keywords – Buffer overflow attack, susceptibility, impediment

Software security risk management in DEVOPS methodology

It’s impossible to talk about cloud technologies, modern applications and, in general, digital transformation, and not to mention security. The same applies to software development, in particular the DevOps methodology. DevOps is a software development methodology that focuses on communication, integration, and collaboration between IT professionals ensuring rapid product deployment. DevOps practice reflects the idea of continuous improvement and automation. Many practices are designed for one or more stages of the development cycle. Three hundred hours spent on software development can be wasted in just 30 seconds, if only one defect during operation is detected. This, subsequently, can ruin reputation of the whole product, and as a result there will be no choice but to simply remove it from the market. And this establishes the importance and necessity of quality control [1].
 To ensure quality of software products during development risk management should be used at every stage of the DevOps lifecycle. Implementing DevOps without paying attention to security will definitely increase risks of attacks. Risk is the occurrence of an uncertain event that positively or negatively affects measured criteria of project success. These can be events that have happened in the past or current events, or something that may happen in the future. These uncertain events can affect target, business, technical and qualitative objectives of the project [2].
 Main stages of risk management include:
 
 risk identification;
 risk analysis and assessment;
 risk response;
 risk monitoring and control.
 
 The purpose of the article is to choose the method of risk analysis and assessment in the DevOps methodology. When using risk management model in DevOps, it is important to choose risk assessment method that is optimal for the criteria relevant to DevOps. To such criteria authors attribute cost of resources, time spent, accuracy of evaluation. Therefore, the choice of risk assessment method is an important component of the process of creating secure software. Risk assessment methods such as PRisMA, PRAM, FMEA, DREAD and FTA were considered in this work.

Systematic Literature Review on Security Risks and its Practices in Secure Software Development

Security is one of the most critical aspects of software quality. Software security refers to the process of creating and developing software that assures the integrity, confidentiality, and availability of its code, data, and services. Software development organizations treat security as an afterthought issue, and as a result, they continue to face security threats. Incorporating security at any level of the Software Development Life Cycle (SDLC) has become an urgent requirement. Several methodologies, strategies, and models have been proposed and developed to address software security, but only a few of them give reliable evidence for creating secure software applications. Software security issues, on the other hand, have not been adequately addressed, and integrating security procedures into the SDLC remains a challenge. The major purpose of this paper is to learn about software security risks and practices so that secure software development methods can be better designed. A systematic literature review (SLR) was performed to classify important studies to achieve this goal. Based on the inclusion, exclusion, and quality assessment criteria, a total of 121 studies were chosen. This study identified 145 security risks and 424 best practices that help software development organizations to manage the security in each phase of the SDLC. To pursue secure SDLC, this study prescribed different security activities, which should be followed in each phase of the SDLC. Successful integration of these activities minimizing effort, time, and budget while delivering secure software applications. The findings of this study assist software development organizations in improving the security level of their software products and also enhancing their security efficiency. This will raise the developer’s awareness of secure development practices as well.

Security Assurance Model of Software Development for Global Software Development Vendors

The number of security attacks and the impact has grown considerably in the recent several years. As a result, new emerging software development models are required that assist in developing software that is secure by default. This article reviews the most widely used security software models. It proposes a new Security Assurance Model (SAM) for Software Development that is adaptable to all contemporary scenarios, emphasizing global software development (GSD) vendor companies. The SAM of Software Development was developed after studying 11 well-known development models and analyzing results obtained from a systematic literature review (SLR) and questionnaire survey. The SAM of Software Development consists of seven security assurance levels: Governance and Security Threat Analysis, Secure Requirement Analysis, Secure Design, Secure Coding, Secure Testing and Review, Secure Deployment, and Security Improvement. The security assurance levels of SAM of software development consist of 46 critical software security risks (CSSRs) and 388 practices for addressing these risks. The proposed SAM of Software Development was assessed based on a tool created by Motorola, which is used to evaluate the present state of a company’s software processes and find areas for improvement. We conducted 3 case studies on software development companies, using data from real software projects to examine the results of a practical experiment in each company. The results of the case studies indicate that the proposed SAM of Software Development helps measure the security assurance level of an organization. In addition, it can potentially serve as a framework for researchers to develop new software security measures.

A hierarchical model for quantifying software security based on static analysis alerts and software metrics

Despite the acknowledged importance of quantitative security assessment in secure software development, current literature still lacks an efficient model for measuring internal software security risk. To this end, in this paper, we introduce a hierarchical security assessment model (SAM), able to assess the internal security level of software products based on low-level indicators, i.e., security-relevant static analysis alerts and software metrics. The model, following the guidelines of ISO/IEC 25010, and based on a set of thresholds and weights, systematically aggregates these low-level indicators in order to produce a high-level security score that reflects the internal security level of the analyzed software. The proposed model is practical, since it is fully automated and operationalized in the form of a standalone tool and as part of a broader Computer-Aided Software Engineering (CASE) platform. In order to enhance its reliability, the thresholds of the model were calibrated based on a repository of 100 popular software applications retrieved from Maven Repository. Furthermore, its weights were elicited in a way to chiefly reflect the knowledge expressed by the Common Weakness Enumeration (CWE), through a novel weights elicitation approach grounded on popular decision-making techniques. The proposed model was evaluated on a large repository of 150 open-source software applications retrieved from GitHub and 1200 classes retrieved from the OWASP Benchmark. The results of the experiments revealed the capacity of the proposed model to reliably assess internal security at both product level and class level of granularity, with sufficient discretion power. They also provide preliminary evidence for the ability of the model to be used as the basis for vulnerability prediction. To the best of our knowledge, this is the first fully automated, operationalized and sufficiently evaluated security assessment model in the modern literature.

Managing Software Security Risks through an Integrated Computational Method

Security risk evaluation of web-based healthcare applications is important from a design perspective. The developers as well as the users need to make sure that the applications must be secure. Citing the disastrous effects of unsecured web applications, <i>Accuntix Online</i> states that the IT industry has lost millions of dollars due to security theft and malware attacks. Protecting the integrity of patients’ health data is of utmost importance. Thus, assessing the security risk of web-based healthcare applications should be accorded the highest priority while developing the web applications. To fulfill the security requirements, the developers must meticulously follow the Multi-Criteria Decision-Making (MCDM) methodology in the assortment of the most effective procedure for security assessment right from the developmental phase of the application. To address the security-related issues in web-based healthcare applications, we have followed the fuzzy-based integrated technique to assess the security risk of web-based healthcare applications. Further, the integrated technology is the combination of Analytic Hierarchy Process (F-AHP) and Technique for Order of Preference by Similarity to Ideal Solution (F-TOPSIS) techniques. The F-AHP approach gives the weights of the factors. We classified the risks into two-levels, Level one had the safety measures factors such as access control, integrity, confidentiality, and, authentication. We selected ten different web-based healthcare applications as alternatives. The calculations based on the proposed methodology ranked the <i>pattern system for access control</i> to be the most prioritized attribute. The outcomes of the study and the procedure used in this assessment would support future research and specialists’ initiatives in organizing web applications through advanced supportable safety and security.

Seasonality and Software Vulnerabilities in Major Database Management Systems

Popularity and marketshare are very important index for software users and vendors since more popular systems tend to engage better user experience and environments. periodical fluctuations in the popularity and marketshare could be vital factors when we estimate the potential risk analysis in target systems. Meanwhile, software vulnerabilities, in major relational database management systems, are detected every now and then. Today, all most every organizations depend on those database systems for store and retrieve their any kinds of informations for the reasons of security, effectiveness, etc. They have to manage and evaluate the level of risks created by the software vulnerabilities so that they could avoid potential losses before the security defects damage their reputations. Here, we examine the seasonal fluctuations with respect to the view of software security risks in the four major database systems, namely MySQL, MariaDB, Oracle Database and Microsoft SQL Server.

Seasonality and Software Vulnerabilities in Major Database Management Systems

Popularity and marketshare are very important index for software users and vendors since more popular systems tend to engage better user experience and environments. periodical fluctuations in the popularity and marketshare could be vital factors when we estimate the potential risk analysis in target systems. Meanwhile, software vulnerabilities, in major relational database management systems, are detected every now and then. Today, all most every organizations depend on those database systems for store and retrieve their any kinds of informations for the reasons of security, effectiveness, etc. They have to manage and evaluate the level of risks created by the software vulnerabilities so that they could avoid potential losses before the security defects damage their reputations. Here, we examine the seasonal fluctuations with respect to the view of software security risks in the four major database systems, namely MySQL, MariaDB, Oracle Database and Microsoft SQL Server.

Managing Security-Risks for Improving Security-Durability of Institutional Web-Applications: Design Perspective

The advanced technological need, exacerbated by the flexible time constraints, leads to several more design level unexplored vulnerabilities. Security is an extremely vital component in software development; we must take charge of security and therefore analysis of software security risk assumes utmost significance. In order to handle the cyber-security risk of the web application and protect individuals, information and properties effectively, one must consider what needs to be secured, what are the perceived threats and the protection of assets. Security preparation plans, implements, tracks, updates and consistently develops safety risk management activities. Risk management must be interpreted as the major component for tackling security efficiently. In particular, during application development, security is considered as an add-on but not the main issue. It is important for the researchers to stress on the consideration of protection right from the earlier developmental stages of the software. This approach will help in designing software which can itself combat threats and does not depend on external security programs. Therefore, it is essential to evaluate the impact of security risks during software design. In this paper the researchers have used the hybrid Fuzzy AHP-TOPSIS method to evaluate the risks for improving security durability of different Institutional Web Applications. In addition, the e-component of security risk is measured on software durability, and vice versa. The paper’s findings will prove to be valuable for enhancing the security durability of different web applications.

Technical debt as an indicator of software security risk: a machine learning approach for software development enterprises

ABSTRACT Vulnerability prediction facilitates the development of secure software, as it enables the identification and mitigation of security risks early enough in the software development lifecycle. Although several factors have been studied for their ability to indicate software security risk, very limited attention has been given to technical debt (TD), despite its potential relevance to software security. To this end, in the present study, we investigate the ability of common TD indicators to indicate security risks in software products, both at project-level and at class-level of granularity. Our findings suggest that TD indicators may potentially act as security indicators as well.

Towards a Conceptual Framework for Security Requirements Work in Agile Software Development

Security requirement work plays a key role in achieving cost-effective and adequate security in a software development project. Knowledge about software companies' experiences of security requirement work is important in order to bridge the observed gap between software security practices and security risks in many projects today. Particularly, such knowledge can help researchers improve on available practices and recommendations. This article uses the results of published empirical studies on security requirement work to create a conceptual framework that shows key concepts related to work context, this work itself and the effects of this work. The resulting framework points to the following research challenges: 1) Identifying and understanding factors important for the effect of security requirements work; 2) Understanding what is the importance of the chosen requirements approach itself, and; 3) Properly taking into account contextual factors, especially factors related to individuals and interactions, in planning and analysis of empirical studies on security requirements work.

Security Risks in the Software Development Lifecycle

Security is a significant concern in software development. Risks and errors should be reduced and as much as possible eliminated. Especially with how the computer and internet provide numerous technological benefits and are being optimally utilized in the present times, users have high expectations when it comes to secure software products. The development cycle in software design is comprised of a systematic process wherein security risk assessment should be integrated into each phase. In order to ensure quality software with a high level of security, the best practices in risk management should be implemented from the beginning and should be performed throughout the process. While developing highly secure software is a complex task, therefore, it must involve more dedicated security activities that are usually ignored in traditional SDLC. In this paper, the nature and phases of secure software development will be discussed as well as the security risk assessment models and practices involved in it. This will provide software developers, programmers, or engineers the awareness on secure software development cycle which will allow them to plan efficient strategies and enhance their performance, thus, resulting in quality and reliable output. In addition, we present a qualitative study looking at real-life practice employed towards software security risk. We reflect on how well current risk practices follow best practice, identify pitfalls, and explore why these occur &amp; mitigate.

Safe, Secure Executions at the Network Edge: Coordinating Cloud, Edge, and Fog Computing

System design where cyber-physical applications are securely coordinated from the cloud may simplify the development process. However, all private data are then pushed to these remote “swamps,” and human users lose actual control as compared to when the applications are executed directly on their devices. At the same time, computing at the network edge is still lacking support for such straightforward multidevice development, which is essential for a wide range of dynamic cyber-physical services. This article proposes a novel programming model as well as contributes the associated secure-connectivity framework for leveraging safe coordinated device proximity as an additional degree of freedom between the remote cloud and the safety-critical network edge, especially under uncertain environment constraints. This article is part of a special issue on Software Safety and Security Risk Mitigation in Cyber-physical Systems.

Probabilistic Security Threat Detection for Risk Management in Cyber-Physical Medical Systems

Medical devices are complex cyber-physical systems incorporating emergent hardware and software components. However, this complexity leads to a wide attack surface posing security risks and vulnerabilities. Mitigation and management of such risks during premarket design and postmarket deployment are required. Dynamically mitigating threat potential in the presence of unknown vulnerabilities requires an adaptive risk-based scheme to assess the system’s state, a secure system architecture that can isolate hardware and software components, and design methods that can adaptively adjust the system’s topology based on risk changes. The essential complementary aspects during deployment are detecting, characterizing, and quantifying security threats. This article presents a dynamic risk management and mitigation approach based on probabilistic threat estimation. A smart-connected-pacemaker case study illustrates the approach. This article is part of a special issue on Software Safety and Security Risk Mitigation in Cyber-physical Systems.

Probabilistic Threat Detection for Risk Management in Cyber-physical Medical Systems

Medical devices are complex cyber-physical systems incorporating emergent hardware and software components. However, this complexity leads to a wide attack surface posing security risks and vulnerabilities. Mitigation and management of such risks during premarket design and postmarket deployment are required. Dynamically mitigating threat potential in the presence of unknown vulnerabilities requires an adaptive risk-based scheme to assess the system’s state, a secure system architecture that can isolate hardware and software components, and design methods that can adaptively adjust the system’s topology based on risk changes. The essential complementary aspects during deployment are detecting, characterizing, and quantifying security threats. This article presents a dynamic risk management and mitigation approach based on probabilistic threat estimation. A smart-connected-pacemaker case study illustrates the approach. This article is part of a special issue on Software Safety and Security Risk Mitigation in Cyber-physical Systems.

Safe and Secure Execution at the Network Edge: A Framework for Coordinating Cloud, Fog, and Edge

System design where cyber-physical applications are securely coordinated from the cloud may simplify the development process. However, all private data are then pushed to these remote “swamps,” and human users lose actual control as compared to when the applications are executed directly on their devices. At the same time, computing at the network edge is still lacking support for such straightforward multidevice development, which is essential for a wide range of dynamic cyber-physical services. This article proposes a novel programming model as well as contributes the associated secure-connectivity framework for leveraging safe coordinated device proximity as an additional degree of freedom between the remote cloud and the safety-critical network edge, especially under uncertain environment constraints. This article is part of a special issue on Software Safety and Security Risk Mitigation in Cyber-physical Systems.