jehanweerasuriya/uni-ai-dataset huggingface dataset:
A Novel Lightweight Solo Software Development Methodology With Optimum Security Practices
Authors: Sibonile Moyo, Ernest Mnkandla
Published in: IEEE Access (2020-01-01)

The diffusion of software into all areas of life and all forms of business, increases the demand for high-quality and secure software products. Software development methodologies are designed to improve the quality of software by incorporating practices that promote quality in the developed software. Software security is an important facet of software quality, particularly in this era, where most software is deployed for use over the Internet. Most research on developing high-quality and secure software is normally focused on teams at the expense of individual developers. In trying to fill this gap, in this paper we propose an agile secure-software development methodology. We design a methodology that promotes quality and security in the software products of solo developers. We integrate quality practices with lightweight security practices to produce agile secure software development practices. We draw quality practices from a solo software development framework designed in our previous study, while security practices are drawn from existing lightweight methodologies. We adapt Keramati and Mirian-Hosseinabadi's algorithm to integrate the two sets of practices, taking care to maintain an optimum degree of agility in the target methodology. We evaluate the utility of the resultant methodology through a case study. Results from the case study show that our proposed methodology can be used to build quality and secure software products without compromising the agility of the methodology.
End-to-End Database Software Security
Authors: Denis Ulybyshev, Michael Rogers, Vadim Kholodilo, Bradley Northern
Published in: Software (2023-03-29)

End-to-end security is essential for relational database software. Most database management software provide data protection at the server side and in transit, but data are no longer protected once they arrive at the client software. In this paper, we present a methodology that, in addition to server-side security, protects data in transit and at rest on the application client side. Our solution enables flexible attribute-based and role-based access control, such that, for a given role or user with a given set of attributes, access can be granted to a relation, a column, or even to a particular data cell of the relation, depending on the data content. Our attribute-based access control model considers the client’s attributes, such as versions of the operating system and the web browser, as well as type of the client’s device. The solution supports decentralized data access and peer-to-peer data sharing in the form of an encrypted and digitally signed spreadsheet container that stores data retrieved by SQL queries from a database, along with data privileges. For extra security, keys for data encryption and decryption are generated on the fly. We show that our solution is successfully integrated with the PostgreSQL® database management system and enables more flexible access control for added security.
Software security analysis and assessment model for the web-based applications
Authors: Yuxuan Wang, William M. Lively, Dick B. Simmons
Published in: Journal of Computational Methods in Sciences and Engineering (2009-07-30)

For web-based applications, a security analysis was conducted in order to identify software vulnerabilities and develop a new security assessment model. During such an analysis, the major security vulnerabilities observed in the open web proxy honeypot during the data collection time from February to March 2005 were computer worm attacks in Code Red and Nimda, AWSTAT attacks, unauthorized access request (HTTP error code 403), MS-SQL version overflow attacks, etc. To develop the security assessment model, we extended the generic security model for a single component system to multiple components using the multidimensional Markov process model. The resulting model was applied to the most popular software systems. The software system availability in security is computed using real data, and the mean time to security failure is calculated. This paper not only provides the software vulnerability analysis of the web-based applications, but also details the software security assessment for multiple component systems.
Labeling Software Security Vulnerabilities
Authors: Irena Bojanova, John J. Guerrerio
Published in: IT Professional (2023-09-01)

Labeling software security vulnerabilities would greatly benefit modern AI cybersecurity research. The National Vulnerability Database (NVD) partially achieves this via assignment of Common Weakness Enumeration (CWE) entries to Common Vulnerabilities and Exposures (CVE) entries. In this work, we explore utilization of the Bugs Framework (BF) formalism for systematic and comprehensive CVE labeling. We specify all memory-related CWEs via BF weaknesses and examine the suitability of these formalisms to describe the corresponding CVEs mapped by NVD. We also identify similarities and overlaps in CWEs that introduce ambiguities in NVD assignments.
Who is liable for bugs and security flaws in software?
Authors: Michael A. Cusumano
Published in: Communications of the ACM (2004-03-01)

Attempting to determine fault and responsibility based on available evidence.
Security Threat and Vulnerability Assessment and Measurement in Secure Software Development
Authors: Mamoona Humayun, N. Z. Jhanjhi, Maram Fahhad Almufareh, Muhammad Ibrahim Khalil
Published in: Computers, materials & continua/Computers, materials & continua (Print) (2022-01-01)

Security is critical to the success of software, particularly in today's fast-paced, technology-driven environment. It ensures that data, code, and services maintain their CIA (Confidentiality, Integrity, and Availability). This is only possible if security is taken into account at all stages of the SDLC (Software Development Life Cycle). Various approaches to software quality have been developed, such as CMMI (Capability maturity model integration). However, there exists no explicit solution for incorporating security into all phases of SDLC. One of the major causes of pervasive vulnerabilities is a failure to prioritize security. Even the most proactive companies use the “patch and penetrate” strategy, in which security is accessed once the job is completed. Increased cost, time overrun, not integrating testing and input in SDLC, usage of third-party tools and components, and lack of knowledge are all reasons for not paying attention to the security angle during the SDLC, despite the fact that secure software development is essential for business continuity and survival in today's ICT world. There is a need to implement best practices in SDLC to address security at all levels. To fill this gap, we have provided a detailed overview of secure software development practices while taking care of project costs and deadlines. We proposed a secure SDLC framework based on the identified practices, which integrates the best security practices in various SDLC phases. A mathematical model is used to validate the proposed framework. A case study and findings show that the proposed system aids in the integration of security best practices into the overall SDLC, resulting in more secure applications.
Technology Transfer: A Software Security Marketplace Case Study
Authors: Gary McGraw
Published in: IEEE Software (2011-08-16)

This paper presents the software security (application security) solutions. It is an idea of engineering software so that it continues to function correctly under malicious attack. Although as a discipline software security is relatively young, much progress has been made on ways to integrate security best practices into the software development life cycle. Microsoft, for example, has helped spearhead soft ware security through its Trustworthy Computing Initiative and the resulting Security Development Lifecycle (SDL). Cigital has also been instrumental in bringing software security to the wider market through its professional services.
Quality Competition and Market Segmentation in the Security Software Market1
Authors: Debabrata Dey, Atanu Lahiri, Guoying Zhang
Published in: MIS Quarterly (2014-06-01)

In recent years, we have witnessed an unprecedented growth in the security software market. This market is now fiercely competitive with hundreds of nearly identical products; yet, the price is high and coverage low. Although recent research has examined such idiosyncrasies and found the existence of a negative network effect as a possible explanation, several important questions still remain: (1) What possibly discourages product differentiation in such a competitive market? (2) Why is versioning absent here? (3) How does the presence of free alternatives in this market impact its structure? We develop a comprehensive oligopoly model, with endogenous quality and versioning decisions, to address these issues. Our analyses reveal that, although the presence of numerous competitors leads to a greater need to differentiate, the network effect in this market works as a counterweight, incentivizing vendors to sacrifice differentiation in favor of collocating in the top end of the quality spectrum. We explain the reasons and implications of this important finding. We further show that this result is robust and applicable even when versioning by competing vendors or the presence of free software is taken into consideration. Furthermore, given that the presence of free software actually intensifies competitive pressure and heightens the need to differentiate, the role of the network effect in abating differentiation becomes even more discernible.
Security Responses in Software Development
Authors: Tamara López, Helen Sharp, Arosha K. Bandara, Thein Thun Tun, Mark Levine, Bashar Nuseibeh
Published in: ACM Transactions on Software Engineering and Methodology (2022-09-12)

The pressure on software developers to produce secure software has never been greater. But what does security look like in environments that do not produce security-critical software? In answer to this question, this multi-sited ethnographic study characterizes security episodes and identifies five typical behaviors in software development. Using theory drawn from information security and motivation research in software engineering, this article characterizes key ways in which individual developers form security responses to meet the demands of particular circumstances, providing a framework managers and teams can use to recognize, understand, and alter security activity in their environments.
Software Security Economics: Theory, in Practice.
Authors: Stephan Neuhaus, Bernhard Plattner
Published in:  (2012-01-01)

In economic models of cybersecurity, security investment yields positive, but diminishing, returns. If that were true for software vulnerabilities, fix rates should decrease, whereas the time between successive fixes should go up as vulnerabilities become fewer and harder to fix. In this work, we examine the empirical evidence for this hypothesis for Mozilla, Apache
Feature interaction: the security threat from within software systems
Authors: Armstrong Nhlabatsi, Robin Laney, Bashar Nuseibeh
Published in: Progress in Informatics (2008-03-01)

Security engineering is about protecting assets from harm. The feature interaction problem occurs when the composition of features leads to undesirable system behaviours. Usually, this problem manifests itself as conflicting actions of features on a shared context. Security requirements may be violated by feature interactions creating security vulnerabilities which can potentially be exploited by attackers. In this paper, we discuss the feature interaction problem and some of its possible implications for security requirements. The paper concludes that (1) the detection of the violation of security requirements by feature interactions is not different from other types of requirements -what differs is the impact of such violation; and (2) feature interaction detection approaches can be used as a means for vulnerability analysis.
Software-Defined Networking (SDN): the security review
Authors: Ali Hussein, Louma Chadad, Nareg Adalian, Ali Chehab, Imad H. Elhajj, Ayman Kayssi
Published in: Journal of Cyber Security Technology (2019-08-08)

The search for better networking paradigms has fostered the emergence of Software Defined Networking (SDN), which allows the decoupling of the data plane from the control plane and to configure the network dynamically. SDN provides network operators with significant visibility and granularity of their networks leading to more flexibility in programming these networks. Typically, with every new technology paradigm, the security concerns represent a serious challenge. In this paper, we provide a comprehensive SDN security review including the different vulnerabilities and attacks that SDN suffers from. The objective is to entice the SDN community to address such issues inherently and not as an afterthought. The paper also reviews the different security proposals that have been presented or implemented for SDN and by SDN. A general discussion is included to shed light on the pending security issues and some proposed solutions are presented.
A Survey on Software-Defined Network and OpenFlow: From Concept to Implementation
Authors: Fei Hu, Qi Hao, Ke Bao
Published in: IEEE Communications Surveys & Tutorials (2014-01-01)

Software-defined network (SDN) has become one of the most important architectures for the management of largescale complex networks, which may require repolicing or reconfigurations from time to time. SDN achieves easy repolicing by decoupling the control plane from data plane. Thus, the network routers/switches just simply forward packets by following the flow table rules set by the control plane. Currently, OpenFlow is the most popular SDN protocol/standard and has a set of design specifications. Although SDN/OpenFlow is a relatively new area, it has attracted much attention from both academia and industry. In this paper, we will conduct a comprehensive survey of the important topics in SDN/OpenFlow implementation, including the basic concept, applications, language abstraction, controller, virtualization, quality of service, security, and its integration with wireless and optical networks. We will compare the pros and cons of different schemes and discuss the future research trends in this exciting area. This survey can help both industry and academia R&D people to understand the latest progress of SDN/OpenFlow designs.
Security Issues in Software Defined Networking (SDN): Risks, Challenges and Potential Solutions
Authors: Maham Iqbal, Farwa Iqbal, Fatima Mohsin, Muhammad Rizwan, Fahad Ahmad
Published in: International Journal of Advanced Computer Science and Applications (2019-01-01)

SDN (Software Defined Networking) is an architecture that aims to improve the control of network and flexibility. It is mainly connected with open flow protocol and ODIN V2 for wireless communication. Its architecture is central, agile and programmatically configured. This paper presents a security analysis that enforces the protection of GUI by requiring authentication, SSL/TLS integration and logging/security audit services. The role based authorization FortNOX and ciphers like AES and DES will be used for encryption of data and improving the security of SDN environment. These techniques are useful for enhancing the security framework of the controller.
SECURE TROPOS: A SECURITY-ORIENTED EXTENSION OF THE TROPOS METHODOLOGY
Authors: Haralambos Mouratidis, Paolo Giorgini
Published in: International Journal of Software Engineering and Knowledge Engineering (2007-04-01)

Although security plays an important role in the development of multiagent systems, a careful analysis of software development processes shows that the definition of security requirements is, usually considered after the design of the system. One of the reasons is the fact that agent oriented software engineering methodologies have not integrated security concerns throughout their developing stages. The integration of security concerns during the whole range of the development stages can help in the development of more secure multiagent systems. In this paper we introduce extensions to the Tropos methodology to enable it to model security concerns throughout the whole development process. A description of the new concepts and modelling activities is given together with a discussion on how these concepts and modelling activities are integrated to the current stages of Tropos. A real life case study from the health and social care sector is used to illustrate the approach.
Security risks of global software development life cycle: Industry practitioner's perspective
Authors: Rafiq Ahmad Khan, Siffat Ullah Khan, Muhammad Azeem Akbar, Musaad Alzahrani
Published in: Journal of Software Evolution and Process (2022-11-23)

Abstract Software security has become increasingly important because the malicious attack and other hacker risks of a computer system have grown popularity in the last few years. As a result, several researchers have examined security solutions as early as the requirement engineering phase. With the growth of the software business and the internet, there is a need to understand the security risks against each phase of the software development life cycle (SDLC). This study aims to empirically investigate and prioritize the risks that could negatively impact the software security aspects of SDLC in the context of global software development (GSD). To achieve the study objectives, we conducted an industrial empirical study to determine the impact of software security threats against each phase of SDLC. Furthermore, the fuzzy analytical hierarchy process (FAHP) was used to prioritize the list of software security risks against the SDLC. The results and analysis of this study provide a ranked‐based decision‐making framework, which assists the practitioners in considering the most critical security risks on priority. The results show “improper plan for secure requirement identification, inception, authentication, authorization, and privacy,” “lack of threat models updating,” “lack of output validation,” “lack of certification in the final release and archive,” and “spoofing” as the top‐ranked security risks of SDLC in GSD. In addition, the application of FAHP is novel in this domain as it is helpful to address multicriteria decision‐making problems.
Network Software Security and User Incentives
Authors: Terrence August, Tunay I. Tunca
Published in:  (2004-10-01)

We study the effect of user incentives on software security in a network of individual users under costly patching and negative network security externalities. For proprietary software or freeware, we compare four alternative policies to manage network security: (i) Consumer self patching (where no external incentives are provided for patching or purchasing); (ii) Mandatory patching; (iii) Patching rebate; and (iv) Usage tax. We show that for proprietary software, when the software security risk and the patching costs are high, for both a welfare maximizing social planner and a profit maximizing vendor, a patching rebate dominates the other policies. However, when the patching cost or the security risk is low, self patching is best. We also show that when a rebate is effective, the profit maximizing rebate is decreasing in the security risk and increasing in patching costs. The welfare maximizing rebates are also increasing in patching costs but can be increasing in the effective security risk when patching costs are high. For freeware, a usage tax is the most effective policy except when both patching costs and security risk are low, in which case, a patching rebate prevails. Optimal patching rebates and taxes tend to increase with increased security risk and patching costs but can decrease in the security risk for high risk levels. Our results suggest that both the value generated from software and vendor profits can be significantly improved by mechanisms that target user incentives to maintain software security.
Software security in practice: knowledge and motivation
Authors: Hala Assal, Srivathsan G. Morkonda, Muhammad Zaid Arif, Sonia Chiasson
Published in: Journal of Cybersecurity (2025-01-01)

Abstract Developing secure software remains a challenge for developers despite the availability of security resources and secure development tools. Common factors affecting software security include the developer’s security awareness and the rationales behind their development decisions with respect to security. In this work, we conducted interviews with software developers to examine how developers in organizations acquire security knowledge, and what factors motivate or prevent developers from adopting software security practices. Our analysis reveals that developers’ security knowledge and motivations are intertwined aspects that are both important for promoting security in development teams. We identified a variety of learning opportunities used by developers and employers for increasing security awareness, including in-context learning activities preferred by developers. Based on our application of the self-determination theory, better security outcomes are expected when developers are internally driven toward security, rather than motivated by external factors; this aligns with our interpretation of participants’ descriptions relating to security outcomes within their teams. Based on our analysis, we provide ideas on how to motivate developers to internalize security and improve their security practices.
On the Relationship between Software Complexity and Security
Authors: Mamdouh Alenezi, Mohammad Zarour
Published in: International Journal of Software Engineering & Applications (2020-01-31)

This work aims at discussing the complexity aspect of software while demonstrating its relationship with security. Complexity is an essential part of software; however, numerous studies indicate that they increase the vulnerability of the software systems and introduce bugs in the program. Many developers face difficulty when trying to understand the complex components of software. Complexity in software increases when objects in the software are used to design a more complex object while creating a hierarchical complexity in the system. However, it is necessary for the developers to strive for minimum complexity, as increased complexity introduces security risks in the software, which can cause severe monetary and reputational damage to a government or a private organization. It even causes bodily harm to human beings with various examples found in previous years where security breaches led to severe consequences. Hence it is vital to maintain low complexity and simple design of structure. Various developers tend to introduce deliberate complexities in the system so that they do not have to write the same program twice; however, it is getting problematic for the software organizations as the demands of security are continually increasing.