jehanweerasuriya/uni-ai-dataset huggingface dataset:
Bridging the Gap between Software Development and Information Security
Authors: Kenneth R. van Wyk, Gary McGraw
Published in: IEEE Security & Privacy (2005-09-01)

Traditionally, software development efforts in large corporations have been about as far removed from information security as they were from human resources or any other business function. Software development has also had the tendency to be highly distributed among business units and thus not even practiced in a cohesive, coherent manner. In the worst cases, busy business unit executives trade roving bands of developers like Pokemon cards in a fifth-grade classroom (in an attempt to get ahead). Suffice it to say, none of this is good. The disconnect between security and development has ultimately produced software development efforts that lack any sort of contemporary understanding of technical security risks. Today's complex and highly connected computing environments trigger myriad security concerns, so by blowing off the idea of security entirely, software builders virtually guarantee that their creations have way too many security weaknesses that could - and should - have been avoided. This article presents some recommendations for solving this problem. Our approach is born out of experience in two diverse fields: software security and information security. Central among our recommendations is the notion of using the knowledge inherent in information security organizations to enhance secure software development efforts.
Incorporating software security: using developer workshops to engage product managers
Authors: Charles Weir, Ingolf Becker, Lynne Blair
Published in: Empirical Software Engineering (2022-12-24)

Abstract Evidence from data breach reports shows that many competent software development teams still do not implement secure, privacy-preserving software, even though techniques to do so are now well-known. A major factor causing this is simply a lack of priority and resources for security, as decided by product managers. So, how can we help developers and product managers to work together to achieve appropriate decisions on security and privacy issues? This paper explores using structured workshops to support teams of developers in engaging product managers with software security and privacy, even in the absence of security professionals. The research used the Design Based Research methodology. This paper describes and justifies our workshop design and implementation, and describes our thematic coding of both participant interviews and workshop discussions to quantify and explore the workshops’ effectiveness. Based on trials in eight organizations, involving 88 developers, we found the workshops effective in helping development teams to identify, promote, and prioritize security issues with product managers. Comparisons between organizations suggested that such workshops are most effective with groups with limited security expertise, and when led by the development team leaders. We also found workshop participants needed minimal guidance to identify security threats, and a wide range of ways to promote possible security improvements. Empowering developers and product managers in this way offers a powerful grassroots approach to improve software security worldwide.
Blockchain-Enabled Distributed Security Framework for Next-Generation IoT: An Edge Cloud and Software-Defined Network-Integrated Approach
Authors: Darshan Vishwasrao Medhane, Arun Kumar Sangaiah, M. Shamim Hossain, Ghulam Muhammad, Jin Wang
Published in: IEEE Internet of Things Journal (2020-02-28)

The Internet of Things (IoT) plays a vital role in the real world by providing autonomous support for communications and operations, thus enabling and promoting novel services that are commonly used in day-to-day life. It is important to do research on security frameworks for next-generation IoT and develop state-of-the-art confidentiality protection schemes to deal with various attacks on IoT networks. In order to offer prominent features like continuous confidentiality, authentication, and robustness, the blockchain technology comes out as a sustainable solution. A blockchain-enabled distributed security framework using edge cloud and software-defined networking (SDN) is presented in this article. The security attack detection is achieved at the cloud layer, and security attacks are consequently reduced at the edge layer of the IoT network. The SDN-enabled gateway offers dynamic network traffic flow management, which contributes to the security attack recognition through determining doubtful network traffic flows and diminishes security attacks through hindering doubtful flows. The results obtained show that the proposed security framework can efficiently and effectively meet the data confidentiality challenges introduced by the integration of blockchain, edge cloud, and SDN paradigm.
Open source software security vulnerability detection based on dynamic behavior features
Authors: Yuancheng Li, Longqiang Ma, Liang Shen, Junfeng Lv, Pan Zhang
Published in: PLoS ONE (2019-08-23)

Open source software has been widely used in various industries due to its openness and flexibility, but it also brings potential security problems. Therefore, security analysis is required before using open source software. The current mainstream open source software vulnerability analysis technology is based on source code, and there are problems such as false positives, false negatives and restatements. In order to solve the problems, based on the further study of behavior feature extraction and vulnerability detection technology, a method of using dynamic behavior features to detect open source software vulnerabilities is proposed. Firstly, the relationship between open source software vulnerability and API call sequence is studied. Then, the behavioral risk vulnerability database of open source software is proposed as a support for vulnerability detection. In addition, the CNN-IndRNN classification model is constructed by improving the Independently Recurrent Neural Net-work (IndRNN) algorithm and applies to open source software security vulnerability detection. The experimental results verify the effectiveness of the proposed open source software security vulnerability detection method based on dynamic behavior features.
Software security: Threats, solutions and challenges
Authors: Himani Mittal
Published in: Computer Software and Media Applications (2024-02-21)

Software security is of great concern as computers have entered almost all walks of life and people at large have become dependent on technology for not only entertainment and communication but for performing tasks involving money and a lot of stake. Software security not only involves securing the software but also user data and communication media. This paper states the several types of security threats that exist since the time networking has evolved, namely, malware, Trojans, viruses, denial of service attacks, and many more. This paper reviews several measures to address these threats. It includes logging, anti-malware, network security methods, and encryption methods. It has been identified that a lot of work has been done to deal with security threats, and it is not only limited to the protection of software but also extends to the protection of data and networks. The existing methods make extensive use of artificial intelligence, and it is identified that there is a need to develop a model that is able to identify known as well as unknown threats. There is a huge scope for research in this area.
Four Software Security Findings
Authors: Gary McGraw
Published in: Computer (2016-01-01)

Analyzing data from 78 firms using the Building Security In Maturity Model (BSIMM) revealed four truths about software security that will help firms protect and secure their assets. Software security continues to grow and evolve, currently accounting for more than 10 percent of global IT security revenue worldwide. On the surface, it seems obvious that we must make software systems secure from the start, but opinions vary as to implementation. Through a multiyear process of observing and measuring security initiatives, we can move beyond opinion into the realm of fact. WHAT follows are four indic
BlockChain: A Distributed Solution to Automotive Security and Privacy
Authors: Ali Dorri, Marco Steger, Salil S. Kanhere, Raja Jurdak
Published in: IEEE Communications Magazine (2017-12-01)

Interconnected smart vehicles offer a range of sophisticated services that benefit the vehicle owners, transport authorities, car manufacturers, and other service providers. This potentially exposes smart vehicles to a range of security and privacy threats such as location tracking or remote hijacking of the vehicle. In this article, we argue that blockchain (BC), a disruptive technology that has found many applications from cryptocurrencies to smart contracts, is a potential solution to these challenges. We propose a BC-based architecture to protect the privacy of users and to increase the security of the vehicular ecosystem. Wireless remote software updates and other emerging services such as dynamic vehicle insurance fees are used to illustrate the efficacy of the proposed security architecture. We also qualitatively argue the resilience of the architecture against common security attacks.
Security vulnerabilities in healthcare: an analysis of medical devices and software
Authors: Carlos Michael Mejía Granda, José Luis Fernández‐Alemán, Juan Manuel Carrillo de Gea, José A. García‐Berná
Published in: Medical & Biological Engineering & Computing (2023-10-04)

The integration of IoT in healthcare has introduced vulnerabilities in medical devices and software, posing risks to patient safety and system integrity. This study aims to bridge the research gap and provide valuable insights for addressing healthcare vulnerabilities and their mitigation mechanisms. Software vulnerabilities related to health systems from 2001 to 2022 were collected from the National Vulnerability Database (NVD) systematized by software developed by the researchers and assessed by a medical specialist for their impact on patient well-being. The analysis revealed electronic health records, wireless infusion pumps, endoscope cameras, and radiology information systems as the most vulnerable. In addition, critical vulnerabilities were identified, including poor credential management and hard-coded credentials. The investigation provides some insights into the consequences of vulnerabilities in health software products, projecting future security issues by 2025, offers mitigation suggestions, and highlights trends in attacks on life support and health systems are also provided. The healthcare industry needs significant improvements in protecting medical devices from cyberattacks. Securing communication channels and network schema and adopting secure software practices is necessary. In addition, collaboration, regulatory adherence, and continuous security monitoring are crucial. Industries, researchers, and stakeholders can utilize these findings to enhance security and safeguard patient safety.
Energy-Efficient End-to-End Security for Software-Defined Vehicular Networks
Authors: Gunasekaran Raja, Sudha Anbalagan, Geetha Vijayaraghavan, Priyanka Dhanasekaran, Yasser D. Al‐Otaibi, Ali Kashif Bashir
Published in: IEEE Transactions on Industrial Informatics (2020-07-28)

One of the most promising application areas of the industrial Internet of Things (IIoT) is vehicular ad hoc networks (VANETs). VANETs are largely used by intelligent transportation systems to provide smart and safe road transport. To reduce the network burden, software-defined networks (SDNs) act as a remote controller. Motivated by the need for greener IIoT solutions, this article proposes an energy-efficient end-to-end security solution for software-defined vehicular networks (SDVNs). Besides, SDN's flexible network management, network performance, and energy-efficient end-to-end security scheme plays a significant role in providing green IIoT services. Thus, the proposed SDVN provides lightweight end-to-end security. The end-to-end security objective is handled in two levels: 1) in roadside unit (RSU)-based group authentication scheme, each vehicle in the RSU range receives a group ID-key pair for secure communication; and 2) in private collaborative intrusion detection system (p-CIDS), the SDVN detects the potential intrusions inside the VANET architecture using collaborative learning that guarantees privacy through a fusion of differential privacy and homomorphic encryption schemes. The SDVN is simulated in NS2 and MATLAB, and results show increased energy efficiency with lower communication and storage overhead than existing frameworks. In addition, the p-CIDS detects the intruder with an accuracy of 96.81% in the SDVN.
Precision Agriculture and Food Security
Authors: Robin Gebbers, Viacheslav I. Adamchuk
Published in: Science (2010-02-11)

Precision agriculture comprises a set of technologies that combines sensors, information systems, enhanced machinery, and informed management to optimize production by accounting for variability and uncertainties within agricultural systems. Adapting production inputs site-specifically within a field and individually for each animal allows better use of resources to maintain the quality of the environment while improving the sustainability of the food supply. Precision agriculture provides a means to monitor the food production chain and manage both the quantity and quality of agricultural produce.
A survey of static analysis methods for identifying security vulnerabilities in software systems
Authors: Marco Pistoia, Satish Chandra, Stephen J. Fink, Eran Yahav
Published in: IBM Systems Journal (2007-01-01)

In this paper we survey static analysis methods for identifying security vulnerabilities in software systems. We cover three areas that have been associated with sources of security vulnerabilities: access-control, information-flow, and application-programming-interface conformance. Because access control mechanisms fall into two major categories, stack-based access control and role-based access control, we discuss static analysis techniques for these two areas of access control separately. Similarly, security violations pertaining to information flow consist of integrity violations and confidentiality violations, and consequently, our discussion of static analysis techniques for information-flow vulnerabilities includes these two topics. For each type of security vulnerability we present our findings in two parts: in the first part we describe recent research results, and in the second part we illustrate implementation techniques by describing selected static analysis algorithms.
A Survey on IoT Security: Application Areas, Security Threats, and Solution Architectures
Authors: Vikas Hassija, Vinay Chamola, Vikas Saxena, Divyansh Jain, Pranav Goyal, Biplab Sikdar
Published in: IEEE Access (2019-01-01)

The Internet of Things (IoT) is the next era of communication. Using the IoT, physical objects can be empowered to create, receive, and exchange data in a seamless manner. Various IoT applications focus on automating different tasks and are trying to empower the inanimate physical objects to act without any human intervention. The existing and upcoming IoT applications are highly promising to increase the level of comfort, efficiency, and automation for the users. To be able to implement such a world in an ever-growing fashion requires high security, privacy, authentication, and recovery from attacks. In this regard, it is imperative to make the required changes in the architecture of the IoT applications for achieving end-to-end secure IoT environments. In this paper, a detailed review of the security-related challenges and sources of threat in the IoT applications is presented. After discussing the security issues, various emerging and existing technologies focused on achieving a high degree of trust in the IoT applications are discussed. Four different technologies, blockchain, fog computing, edge computing, and machine learning, to increase the level of security in IoT are discussed.
Managing Software Security Risks through an Integrated Computational Method
Authors: Abdullah Alharbi, Wael Alosaimi, Hashem Alyami, Mohd Nadeem, Mohd Faizan, Alka Agrawal, Rajeev Kumar, Raees Ahmad Khan
Published in: Intelligent Automation & Soft Computing (2021-01-01)

Security risk evaluation of web-based healthcare applications is important from a design perspective. The developers as well as the users need to make sure that the applications must be secure. Citing the disastrous effects of unsecured web applications, Accuntix Online states that the IT industry has lost millions of dollars due to security theft and malware attacks. Protecting the integrity of patients’ health data is of utmost importance. Thus, assessing the security risk of web-based healthcare applications should be accorded the highest priority while developing the web applications. To fulfill the security requirements, the developers must meticulously follow the Multi-Criteria Decision-Making (MCDM) methodology in the assortment of the most effective procedure for security assessment right from the developmental phase of the application. To address the security-related issues in web-based healthcare applications, we have followed the fuzzy-based integrated technique to assess the security risk of web-based healthcare applications. Further, the integrated technology is the combination of Analytic Hierarchy Process (F-AHP) and Technique for Order of Preference by Similarity to Ideal Solution (F-TOPSIS) techniques. The F-AHP approach gives the weights of the factors. We classified the risks into two-levels, Level one had the safety measures factors such as access control, integrity, confidentiality, and, authentication. We selected ten different web-based healthcare applications as alternatives. The calculations based on the proposed methodology ranked the pattern system for access control to be the most prioritized attribute. The outcomes of the study and the procedure used in this assessment would support future research and specialists’ initiatives in organizing web applications through advanced supportable safety and security.
Software Defined Networking Flow Table Management of OpenFlow Switches Performance and Security Challenges: A Survey
Authors: Babangida Isyaku, Mohd Soperi Mohd Zahid, Maznah Kamat, Kamalrulnizam Abu Bakar, Fuad A. Ghaleb
Published in: Future Internet (2020-08-31)

Software defined networking (SDN) is an emerging network paradigm that decouples the control plane from the data plane. The data plane is composed of forwarding elements called switches and the control plane is composed of controllers. SDN is gaining popularity from industry and academics due to its advantages such as centralized, flexible, and programmable network management. The increasing number of traffics due to the proliferation of the Internet of Thing (IoT) devices may result in two problems: (1) increased processing load of the controller, and (2) insufficient space in the switches’ flow table to accommodate the flow entries. These problems may cause undesired network behavior and unstable network performance, especially in large-scale networks. Many solutions have been proposed to improve the management of the flow table, reducing controller processing load, and mitigating security threats and vulnerabilities on the controllers and switches. This paper provides comprehensive surveys of existing schemes to ensure SDN meets the quality of service (QoS) demands of various applications and cloud services. Finally, potential future research directions are identified and discussed such as management of flow table using machine learning.
Product Strategies and Survival in Schumpeterian Environments: Evidence from the US Security Software Industry
Authors: Marco S. Giarratana, Andréa Fosfuri
Published in: Organization Studies (2007-06-01)

This paper seeks to explore the drivers of survival in environments characterized by high rates of entry and exit, fragmented market shares, rapid pace of product innovation and proliferation of young ventures. The paper aims to underscore the role played by post-entry product strategies, along with their interaction, after carefully controlling for `at entry' factors and demographic conditions. Based on a population of 270 firms that entered the US security software industry between 1989 and 1998, we find evidence that surviving entities are those that are more aggressive in the adoption of versioning and portfolio broadening strategies. In particular, focusing on any one of these two strategies leads to a higher probability of survival as opposed to adopting a mixed strategy.
A Survey on Smartphones Security: Software Vulnerabilities, Malware, and Attacks
Authors: Milad Taleby, Qianmu Li, Mahdi Rabbani, Ahmed Raza
Published in: International Journal of Advanced Computer Science and Applications (2017-01-01)

Nowadays, the usage of smartphones and their applications have become rapidly popular in people’s daily life. Over the last decade, availability of mobile money services such as mobile-payment systems and app markets have significantly increased due to the different forms of apps and connectivity provided by mobile devices, such as 3G, 4G, GPRS, and Wi-Fi, etc. In the same trend, the number of vulnerabilities targeting these services and communication networks has raised as well. Therefore, smartphones have become ideal target devices for malicious programmers. With increasing the number of vulnerabilities and attacks, there has been a corresponding ascent of the security countermeasures presented by the researchers. Due to these reasons, security of the payment systems is one of the most important issues in mobile payment systems. In this survey, we aim to provide a comprehensive and structured overview of the research on security solutions for smartphone devices. This survey reviews the state of the art on security solutions, threats, and vulnerabilities during the period of 2011-2017, by focusing on software attacks, such those to smartphone applications. We outline some countermeasures aimed at protecting smartphones against these groups of attacks, based on the detection rules, data collections and operating systems, especially focusing on open source applications. With this categorization, we want to provide an easy understanding for users and researchers to improve their knowledge about the security and privacy of smartphones.