Investigate how developers and managers view security design in software
- URL: http://arxiv.org/abs/2310.14433v1
- Date: Sun, 22 Oct 2023 22:44:02 GMT
- Title: Investigate how developers and managers view security design in software
- Authors: Asif Imran
- Abstract summary: We interviewed a team of 7 developers and 2 managers, who worked in two teams to build a real-life software product that was recently compromised by a cyber-attack.
We obtained their views on the reasons for the successful attack by the malware and took their recommendations on the important aspects to consider regarding security.
- Score: 0.0
- License: http://creativecommons.org/licenses/by/4.0/
- Abstract: Software security requirements have been traditionally considered as a
non-functional attribute of the software. However, as more software started to
provide services online, existing mechanisms of using firewalls and other
hardware to secure software have lost their applicability. At the same time,
under the current world circumstances, the increase of cyber-attacks on
software is ever increasing. As a result, it is important to consider the
security requirements of software during its design. To design security in the
software, it is important to obtain the views of the developers and managers of
the software. Also, it is important to evaluate if their viewpoints match or
differ regarding the security. Conducting this communication through a specific
model will enable the developers and managers to eliminate any doubts on
security design and adopt an effective strategy to build security into the
software. In this paper, we analyzed the viewpoints of developers and managers
regarding their views on security design. We interviewed a team of 7 developers
and 2 managers, who worked in two teams to build a real-life software product
that was recently compromised by a cyber-attack. We obtained their views on the
reasons for the successful attack by the malware and took their recommendations
on the important aspects to consider regarding security. Based on their
feedback, we coded their open-ended responses into 4 codes, which we
recommended using for other real-life software as well.
Related papers
- An Exploratory Study on the Engineering of Security Features [7.588468985212172]
We study how security features of software systems are selected and engineered in practice.
Based on the empirical data gathered, we provide insights into engineering practices.
arXiv Detail & Related papers (2025-01-20T15:37:53Z) - TrustOps: Continuously Building Trustworthy Software [42.81677042059531]
We argue that gathering verifiable evidence during software development and operations is needed for creating a new trust model.
We present TrustOps, an approach for continuously collecting verifiable evidence in all phases of the software life cycle.
arXiv Detail & Related papers (2024-12-04T10:41:01Z) - An Industry Interview Study of Software Signing for Supply Chain Security [5.433194344896805]
We study the challenges that affect the effective implementation of software signing in practice.
We highlight the different challenges-technical, organizational, and human-that hamper software signing implementation.
arXiv Detail & Related papers (2024-06-12T13:30:53Z) - SoK: A Defense-Oriented Evaluation of Software Supply Chain Security [3.165193382160046]
We argue that the next stage of software supply chain security research and development will benefit greatly from a defense-oriented approach.
This paper introduces the AStRA model, a framework for representing fundamental software supply chain elements and their causal relationships.
arXiv Detail & Related papers (2024-05-23T18:53:48Z) - Purple Llama CyberSecEval: A Secure Coding Benchmark for Language Models [41.068780235482514]
This paper presents CyberSecEval, a comprehensive benchmark developed to help bolster the cybersecurity of Large Language Models (LLMs) employed as coding assistants.
CyberSecEval provides a thorough evaluation of LLMs in two crucial security domains: their propensity to generate insecure code and their level of compliance when asked to assist in cyberattacks.
arXiv Detail & Related papers (2023-12-07T22:07:54Z) - Embedded Software Development with Digital Twins: Specific Requirements
for Small and Medium-Sized Enterprises [55.57032418885258]
Digital twins have the potential for cost-effective software development and maintenance strategies.
We interviewed SMEs about their current development processes.
First results show that real-time requirements prevent, to date, a Software-in-the-Loop development approach.
arXiv Detail & Related papers (2023-09-17T08:56:36Z) - A Novel Approach to Identify Security Controls in Source Code [4.598579706242066]
This paper enumerates a comprehensive list of commonly used security controls and creates a dataset for each one of them.
It uses the state-of-the-art NLP technique Bidirectional Representations from Transformers (BERT) and the Tactic Detector from our prior work to show that security controls could be identified with high confidence.
arXiv Detail & Related papers (2023-07-10T21:14:39Z) - Security for Machine Learning-based Software Systems: a survey of
threats, practices and challenges [0.76146285961466]
How to securely develop the machine learning-based modern software systems (MLBSS) remains a big challenge.
latent vulnerabilities and privacy issues exposed to external users and attackers will be largely neglected and hard to be identified.
We consider that security for machine learning-based software systems may arise from inherent system defects or external adversarial attacks.
arXiv Detail & Related papers (2022-01-12T23:20:25Z) - Empowered and Embedded: Ethics and Agile Processes [60.63670249088117]
We argue that ethical considerations need to be embedded into the (agile) software development process.
We put emphasis on the possibility to implement ethical deliberations in already existing and well established agile software development processes.
arXiv Detail & Related papers (2021-07-15T11:14:03Z) - Dos and Don'ts of Machine Learning in Computer Security [74.1816306998445]
Despite great potential, machine learning in security is prone to subtle pitfalls that undermine its performance.
We identify common pitfalls in the design, implementation, and evaluation of learning-based security systems.
We propose actionable recommendations to support researchers in avoiding or mitigating the pitfalls where possible.
arXiv Detail & Related papers (2020-10-19T13:09:31Z) - Security and Machine Learning in the Real World [33.40597438876848]
We build on our experience evaluating the security of a machine learning software product deployed on a large scale to broaden the conversation to include a systems security view of vulnerabilities.
We propose a list of short-term mitigation suggestions that practitioners deploying machine learning modules can use to secure their systems.
arXiv Detail & Related papers (2020-07-13T16:57:12Z)
This list is automatically generated from the titles and abstracts of the papers in this site.
This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.