jehanweerasuriya/uni-ai-dataset huggingface dataset:
Integrating Software Security into Agile-Scrum Method
Authors: Imran Ghani, Zulkarnain Azham, Seung Min Jeong
Published in: KSII Transactions on Internet and Information Systems (2014-02-28)

Scrum is one of the most popular and efficient agile development methods. However, like other agile methods such as Extreme Programming (XP), Feature Driven Development (FDD), and the Dynamic Systems Development Method (DSDM), Scrum has been criticized because of lack of support to develop secure software. Thus, in 2011, we published research proposing the idea of a security backlog (SB). This paper represents the continuation of our previous research, with a focus on the evaluation in industry-based case study. Our findings highlight an improved agility in Scrum after the integration of SB. Furthermore, secure software can be developed quickly, even in situations involving requirement changes of software. Based on our experimental findings, we noticed that, when integrating SB, it is quite feasible to develop secure software using an agile Scrum model.
Software Security: A Risk Taxonomy
Authors: Kavita Sahu, Babasaheb Ambedkar
Published in:  (2015-01-01)

The implementation of software has been challenging for many organizations. As given in the many reports of important failures, the implementation of packaged software and associated changes in business processes has proved not to be an easy mission. As many organizations have discovered, the implementation of software's systems can be an enormous disaster unless the process is managed cautiously. By calculating and minimizing the major business risks in the first illustration, the scene can be set for the successful performance of software's organization. Almost every software controlled system faces risk from potential adversaries. Software engineers must be cognizant of these security risk and engineer systems with probable defenses, as still delivering value to customers is priority of an organization.Software security risk management and security assessments essentials reproduces several influences. The maximum documentation arrival on security holders encloses the value to customers. In this paper there is a focus on another face of software security risk analysis which connects to arranging software in the market that assists as an intermediate between a software provider, society and its clients.
Generative AI for Software Security Analysis: Fundamentals, Applications, and Challenges
Authors: Ao Ding, Gaolei Li, Xiaoyu Yi, Xi Lin, Jianhua Li, Chaofeng Zhang
Published in: IEEE Software (2024-08-13)

This article delves into the potential opportunities and challenges that generative AI introduces to software security analysis based on its fundamentals and applications. In addition, a simple case is used to demonstrate the validity of our outlook.
Improving Software Security by Preventing Known Vulnerabilities
Authors: David Byers
Published in:  (2013-01-01)

From originally being of little concern, security has become a crucial quality factor in modern software. The risk associated with software insecurity has increased dramatically with increased reli ...
A First Look into Software Security Practices in Bangladesh
Authors: Ankit Shrestha, Tanusree Sharma, Pratyasha Saha, Syed Ishtiaque Ahmed, Mahdi Nasrullah Al-Ameen
Published in: ACM Journal on Computing and Sustainable Societies (2023-08-31)

Software security practices are critical in minimizing vulnerabilities and protecting unauthorized access to the code and the system. However, software security practices outside Western countries need to be better understood. This need for understanding security practices is further necessitated by the increased outsourcing of software development that can result in vulnerabilities on a global scale. This article addresses this gap, focusing on Bangladesh, a country that represents a booming software industry in the Global South. In this study, we conducted semi-structured interviews with 15 developers to understand their security perceptions and identify the factors influencing software security practices in Bangladesh. Our findings unpack how security fits in the local software development life cycle and shed light on the challenges deterring security practices in Bangladesh. Based on our results, we provide recommendations for developing situated and sustainable strategies to support software security practices in the local context.
DASP: A Framework for Driving the Adoption of Software Security Practices
Authors: Enrique Larios Vargas, Omar Elazhary, Soroush Yousefi, Derek Lowlind, Michael Vliek, Margaret‐Anne Storey
Published in: IEEE Transactions on Software Engineering (2023-01-10)

Implementing software security practices is a critical concern in modern software development. Industry practitioners, security tool providers, and researchers have provided standard security guidelines and sophisticated security development tools to ensure a secure software development pipeline. But despite these efforts, there continues to be an increase in the number of vulnerabilities that can be exploited by malicious hackers. There is thus an urgent need to understand why developers still introduce security vulnerabilities into their applications and to understand what can be done to motivate them to write more secure code. To understand and address this problem further, we propose DASP, a framework for diagnosing and driving the adoption of software security practices among developers. DASP was conceived by combining behavioral science theories to shape a cross-sectional interview study with 28 software practitioners. Our interviews lead to a framework that consists of a comprehensive set of 33 drivers grouped into 7 higher-level categories that represent what needs to happen or change so that the adoption of software security practices occurs. Using the DASP framework, organizations can design interventions suitable for developers’ specific development contexts that will motivate them to write more secure code.
Risk-Based Measurement and Analysis: Application to Software Security
Authors: Christopher Alberts, Julia Allen, Robert Stoddard
Published in: Figshare (2018-01-01)

For several years, the software engineering community has been working to identify practices aimed at developing more secure software. Although some foundational work has been performed, efforts to measure software security assurance have yet to materialize in any substantive fashion. As a result, decision makers (e.g., development program and project managers, acquisition program offices) lack confidence in the security characteristics of their software-reliant systems. The CERT® Program at Carnegie Mellon University's Software Engineering Institute (SEI) has chartered the Software Security Measurement and Analysis (SSMA) Project to advance the state-of-the-practice in software security measurement and analysis. The SSMA Project is exploring how to use risk analysis to direct an organization's software security measurement and analysis efforts. The overarching goal is to develop a risk-based approach for measuring and monitoring the security characteristics of interactively complex software-reliant systems across the life cycle and supply chain. To accomplish this goal, the project team has developed the SEI Integrated Measurement and Analysis Framework (IMAF) and refined the SEI Mission Risk Diagnostic (MRD). This report is an update to the technical note, Integrated Measurement and Analysis Framework for Software Security (CMU/SEI-2010-TN-025), published in September 2010. This report presents the foundational concepts of a risk-based approach for software security measurement and analysis and provides an overview of the IMAF and the MRD.
Dynamic software security testing
Authors: Martin R. Stytz, Sheila B. Banks
Published in: IEEE Security & Privacy (2006-05-01)

Current software security techniques aren't able to produce the secure systems demanded by our increasingly interconnected society, so there persists the need for a more effective and scalable approach: dynamic software security testing.
Intrusion detection using the chi-square goodness-of-fit test for information assurance, network, forensics and software security
Authors: Rohitha Goonatilake, Ajantha Herath, Suvineetha Herath, Susantha Herath, Jayantha Herath
Published in: Journal of computing sciences in colleges (2007-10-01)

This paper describes a course module developed to help computer security students understand a use of the X2-, chi-square, goodness-of-fit test to detect possible intrusions. Detecting intrusions not only provides feedback to help design, but also to implement prevention techniques to harden information systems. As statistical or mathematical techniques can identify intrusions, there is a need to introduce these statistical concepts to students in information assurance, network, forensics and software security courses as they attempt to understand intrusions and plan possible responses.
Interventions for long‐term software security: Creating a lightweight program of assurance techniques for developers
Authors: Charles Weir, Ingolf Becker, James Noble, Lynne Blair, M. Angela Sasse, Awais Rashid
Published in: Software Practice and Experience (2019-11-12)

Summary Though some software development teams are highly effective at delivering security, others either do not care or do not have access to security experts to teach them how. Unfortunately, these latter teams are still responsible for the security of the systems they build: systems that are ever more important to ever more people. We propose that a series of lightweight interventions, six hours of facilitated workshops delivered over three months, can improve a team's motivation to consider security and awareness of assurance techniques, changing its security culture even when no security experts are involved. The interventions were developed after an Appreciative Inquiry and Grounded Theory survey of security professionals to find out what approaches work best. We tested the interventions in a participatory action research field study where we delivered the workshops to three software development organizations and evaluated their effectiveness through interviews beforehand, immediately afterwards, and after twelve months. We found that the interventions can be effective with teams with limited or no security experience and that improvement is long‐lasting. This approach and the learning points arising from the work here have the potential to be applied in many development teams, improving the security of software worldwide.
Improving Internet of Things (IoT) Security with Software-Defined Networking (SDN)
Authors: Abdullah Al Hayajneh, Md Zakirul Alam Bhuiyan, Ian McAndrew
Published in: Computers (2020-02-07)

There has been an increase in the usage of Internet of Things (IoT), which has recently become a rising area of interest as it is being extensively used for numerous applications and devices such as wireless sensors, medical devices, sensitive home sensors, and other related IoT devices. Due to the demand to rapidly release new IoT products in the market, security aspects are often overlooked as it takes time to investigate all the possible vulnerabilities. Since IoT devices are internet-based and include sensitive and confidential information, security concerns have been raised and several researchers are exploring methods to improve the security among these types of devices. Software defined networking (SDN) is a promising computer network technology which introduces a central program named ‘SDN Controller’ that allows overall control of the network. Hence, using SDN is an obvious solution to improve IoT networking performance and overcome shortcomings that currently exist. In this paper, we (i) present a system model to effectively use SDN with IoT networks; (ii) present a solution for mitigating man-in-the-middle attacks against IoT that can only use HTTP, which is a critical attack that is hard to defend; and (iii) implement the proposed system model using Raspberry Pi, Kodi Media Center, and Openflow Protocol. Our system implementation and evaluations show that the proposed technique is more resilient to cyber-attacks.
A Policy-Based Security Architecture for Software-Defined Networks
Authors: Vijay Varadharajan, Kallol Krishna Karmakar, Udaya Tupakula, Michael Hitchens
Published in: IEEE Transactions on Information Forensics and Security (2018-08-31)

As networks expand in size and complexity, they pose greater administrative and management challenges. Software-defined networks (SDNs) offer a promising approach to meeting some of these challenges. In this paper, we propose a policy-driven security architecture for securing end-to-end services across multiple SDN domains. We develop a language-based approach to design security policies that are relevant for securing SDN services and communications. We describe the policy language and its use in specifying security policies to control the flow of information in a multi-domain SDN. We demonstrate the specification of fine-grained security policies based on a variety of attributes, such as parameters associated with users and devices/switches, context information, such as location and routing information, and services accessed in SDN as well as security attributes associated with the switches and controllers in different domains. An important feature of our architecture is its ability to specify path- and flow-based security policies that are significant for securing end-to-end services in SDNs. We describe the design and the implementation of our proposed policy-based security architecture and demonstrate its use in scenarios involving both intra- and inter-domain communications with multiple SDN controllers. We analyze the performance characteristics of our architecture as well as discuss how our architecture is able to counteract various security attacks. The dynamic security policy-based approach and the distribution of corresponding security capabilities intelligently as a service layer that enables flow-based security enforcement and protection of multitude of network devices against attacks are important contributions of this paper.
Six Tech Trends Impacting Software Security
Authors: Gary McGraw
Published in: Computer (2017-05-01)

The past few years have seen radical shifts in the way software is developed, in terms of both process and the technology stack. We must actively track these changes to ensure that software security solutions remain relevant.
A Taxonomy and Qualitative Comparison of Program Analysis Techniques for Security Assessment of Android Software
Authors: Alireza Sadeghi, Hamid Bagheri, Joshua Garcia, Sam Malek
Published in: IEEE Transactions on Software Engineering (2016-10-05)

In parallel with the meteoric rise of mobile software, we are witnessing an alarming escalation in the number and sophistication of the security threats targeted at mobile platforms, particularly Android, as the dominant platform. While existing research has made significant progress towards detection and mitigation of Android security, gaps and challenges remain. This paper contributes a comprehensive taxonomy to classify and characterize the state-of-the-art research in this area. We have carefully followed the systematic literature review process, and analyzed the results of more than 300 research papers, resulting in the most comprehensive and elaborate investigation of the literature in this area of research. The systematic analysis of the research literature has revealed patterns, trends, and gaps in the existing literature, and underlined key challenges and opportunities that will shape the focus of future research efforts.
On the Flow of Software Security Advisories
Authors: Lucas Miranda, Daniel Vieira, Leandro Pfleger de Aguiar, Daniel Sadoc Menasché, Miguel Bicudo, Mateus Nogueira, Matheus Martins, Leonardo Ventura, Lucas Senos, Enrico Lovat
Published in: IEEE Transactions on Network and Service Management (2021-05-10)

In this paper, we report results on a large scale measurement campaign to collect temporal information about events associated with software vulnerabilities. The data is curated so as to extract dates from each of the analyzed security advisories. The resulting time series are our object of study. From our measurements we were able to identify which role was assumed by different platforms (such as websites and forums) in the security landscape, including sources and aggregators of information about vulnerabilities. Then, we propose an analytical model to express the flow of information through security advisories across multiple platforms. The model is based on a queueing network, where each platform corresponds to a queue which adds a delay in the information propagation. Such delays, in turn, have an impact on the visibility of the information at different platforms. Leveraging the proposed model and the collected data, we assess how different system parameters, such as the delays incurred by each platform to propagate its messages, impact the overall flow of information across platforms.
Applications of Access Control as a Service for Software Security
Authors: Predrag Dašić, Jovan Dašić, Bojan Crvenković
Published in: International Journal of Industrial Engineering and Management (2016-09-30)

Cloud technology has been around for some time now and is gaining increased influence in almost every aspect of information technology services. As a consequence of above stated, cloud technology offers improvements to traditional security systems by converging logical (cloud network) and physical security (on-site devices). In this paper, we will discuss the application of Access Control as a Service (ACaaS) for software security systems. ACaaS defines a common policy format for security, the translation of the policy into deployment environments and represents an efficient, cost-effective mechanism for access control.
Security Challenges and Opportunities of Software-Defined Networking
Authors: Marc Daciér, Hartmut König, Radoslaw Cwalinski, Frank Kargl, Sven Dietrich
Published in: IEEE Security & Privacy (2017-03-01)

Is software-defined networking (SDN) friend or foe in terms of security? Drawing on a recent Dagstuhl seminar, the authors discuss SDN's security challenges, debate strategies to monitor and protect SDN-enabled networks, and propose methods and strategies to leverage SDN's flexibility for designing new security mechanisms.
Composing security-aware software
Authors: Khaled M. Khan, J. Han
Published in: IEEE Software (2002-01-01)

This article addresses a key issue in security: how to inspire trust by disclosing security properties of software components to others in a component-based software development environment. The authors introduce a component security characterization framework in this endeavor that characterizes security properties by exposing software security profiles to others. The active interface lets software engineers know up front the impact of security properties of a composition's candidate components.
Prioritization of software security intangible attributes
Authors: Regina Thienne Colombo, Marcelo Schneck de Paula Pessôa, Ana Cervigni Guerra, Amandio Balcão Filho, Célio Caruso Gomes
Published in: ACM SIGSOFT Software Engineering Notes (2012-11-27)

Intangible elements, such as value ranges of software security properties (e.g., confidentiality, integrity and availability), can be seen as resources to enforce software security. There are no standard units regarding these properties, turning their measurement into a difficult process. On the other hand, we can measure or estimate priorities for intangible elements from tangible ones, since their priorities are proportional. The priorities of tangible resources can be used to assign values to the priorities of intangible resources through the experience of the involved analysts. In this paper, we present a theoretical process based on mathematical constructs to score the priority and to estimate measures of software security attributes. This process causes the complex systems decomposition into simpler and smaller systems, thus allowing the estimation of properties that will help the understanding and measurement of software security properties. Our results provide a model for access security; the priority score of security attributes is calculated using the AHP methodology. We illustrate the application of our approach in a Web management system for governmental research institutions, presenting results that may support managers in the prioritization, evaluation and management of security requirements related to Web applications.
Software implementation of online risk-based security assessment
Authors: Ming Ni, James D. McCalley, Vijay Vittal, Scott Greene, Chee‐Wooi Ten, Vijaya Ganugula, T. Tayyib
Published in: IEEE Transactions on Power Systems (2003-07-29)

This paper describes software implementation for online risk-based security assessment which computes indices based on probabilistic risk for use by operators in the control room to assess system security levels as a function of existing and near-future network conditions. The paper focuses on speed enhancement techniques that are essential for online application and result visualization methods that offer clear and meaningful ways to enhance human assimilation and comprehension of security levels. Results of testing on a series of 1600 bus power flow models retrieved from the energy management system of a large US utility are presented and serve to illustrate the benefits of the software.
How we Learned to Cheat in Online Poker: A Study in Software Security
Authors: Brad Arkin, Frank Hill, Scott Marks, Matt Schmid, Thomas J. Walls
Published in:  (2006-01-01)

Poker is card game that many people around the world enjoy. Poker is played at kitchen tables, in casinos and cardrooms, and, recently, on the Web. A few of us here at Reliable Software Technologies (http://www.rstcorp.com) play poker. Since many of us spend a good amount of time on-line, it was only a matter of time before some of us put the two interests together. This is the story of how our interests in online poker and software security mixed to create a spectacular security exploit.
A High-level Aspect-oriented-based Framework for Software Security Hardening
Authors: Azzam Mourad, Marc-André Laverdière, Mourad Debbabi
Published in: Information Security Journal A Global Perspective (2008-05-09)

In this paper, we present an aspect-oriented approach and propose a high-level language called SHL (Security Hardening Language) for the systematic security hardening of software. The primary contribution of this proposition is providing the software architects with the capabilities to perform security hardening by applying well-defined solutions and without the need to have expertise in the security solution domain. At the same time, the security hardening is applied in an organized and systematic way in order not to alter the original functionalities of the software. This is done by providing an abstraction over the actions required to improve the security of a program and adopting aspect-oriented programming to build and develop the solutions. SHL allows the developers to describe and specify the security hardening plans and patterns needed to harden systematically security into open source software. It is a minimalist language built on top of the current aspect-oriented technologies that are based on advice-poincut model and can also be used in conjunction with them. We explore the viability and relevance of our proposition by applying it into several security hardening case studies and presenting their experimental results.