## 6 Main Results
### Response to Research Questions  
The main objective of this research is to define a methodological proposal to develop software that integrates the security dimension into all phases of its life cycle. To achieve this, we defined a research design composed of three phases. The first corresponds to the present work, which seeks to identify all the existing formal literature, noting the strengths and weaknesses of the current proposals. The 39 papers ultimately selected were classified into three dimensions: time, category, and type of work. Of the 39 selected articles, there are 17 (44%) that propose implementations in the area of the software industry, from which the answers to the defined research questions can be derived. RQ1: How many articles are related to secure software development? Mapping obtains data on the main related works about software development that integrate security. Of the 39 works found, we identified 35 (see Figure 8) that address security as an important part of secure software development, offering new proposals regarding secure software development, and among these articles, 17 focus on the software industry according to the classification performed. We made this classification to evaluate the state of security integration in agile software development. The classifications used correspond to three dimensions: by time, by context where they are developed, and type of work. Figure 8: Jobs related to secure software development. RQ2: How many articles study security practices for agile software development? We found 5 works that study the integration of security in agile development environments, see Figure 9, of which [68] stands out for establishing security requirements for the design, implementation, verification, and release of secure software through an efficient software security development process. We cannot fail to mention the work reported [71] proposes an agile, secure software development methodology that promotes quality and security in software products of individual developers; however, this proposal does not provide a clear picture of use since it is evaluated in an academic environment and it is, therefore, difficult to generalize the results of the case study. The resulting three related papers build on [72], a comprehensive and detailed review of agile software development in the context of IoT, ITS, and its cybersecurity and risk challenges. An automated risk assessment approach is explored in [69], and an exploratory study on agile security practices adopted by software developers and security practitioners is presented in [75]. RQ3: What is the context/setting where the articles take place? Based on Figure 7, it is possible to determine the contexts in which the selected research is conducted. Most of the works are developed in the software industry, with 25 articles. This is followed by 16 articles undertaken in the area of vulnerabilities. In the area of critical infrastructure, we have 7 works as well as in organizations and finally with 2 and 1 work in the areas of cybersecurity education and health, respectively. See Table 4.  
RQ4: What are the SDLC phases that have most addressed security in software development? We found several articles that propose methods to address security in software development involving all phases of the software development cycle. In this sense, it is essential to point out that, of the 17 articles that propose implementations, there are 9 articles that address security in all phases of the SDLC, which represents 23% of the total. From the above analysis, we can answer the following research question:  
RQ5: Which particular phase of SDLC has been least discussed and addressed in the literature? \begin{table}
\begin{tabular}{c c} \hline \hline
**Classification** & **Total** \\ \hline Health & 1 \\ Organizations & 7 \\ Vulnerabilities & 16 \\ Cybersecurity Education & 2 \\ Critical Infrastructure & 7 \\ Software Security & 25 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Contexts of the articles.