jehanweerasuriya/uni-ai-dataset huggingface dataset:
Collaborative security risk estimation in agile software development
Authors: Inger Anne Tøndel, Martin Gilje Jaatun, Daniela S. Cruzes, Laurie Williams
Published in: Information and Computer Security (2019-06-17)

Purpose Today, agile software development teams in general do not adopt security risk-assessment practices in an ongoing manner to prioritize security work. Protection Poker is a collaborative and lightweight software security risk-estimation technique that is particularly suited for agile teams. Motivated by a desire to understand why security risk assessments have not yet gained widespread adoption in agile development, this study aims to assess to what extent the Protection Poker game would be accepted by agile teams and how it can be successfully integrated into the agile practices. Design/methodology/approach Protection Poker was studied in capstone projects, in teams doing a graduate software security course and in sessions with industry representatives. Data were collected via questionnaires, observations and group interviews. Findings Results show that Protection Poker has the potential to be adopted by agile teams. Key benefits include good discussions on security and the development project, along with increased knowledge and awareness. Challenges include ensuring efficient use of time and gaining impact on the end product. Research limitations/implications Using students allowed easy access to subjects and an ability to collect rich data over time, but at the cost of generalizability to professional settings. Results from interactions with professionals supplement the data from students, showing similarities and differences in their opinions on Protection Poker. Originality/value The paper proposes ways to tackle the main obstacles to the adoption of the Protection Poker technique, as identified in this study.
Security software engineering in wireless sensor networks
Authors: Eric Platon, Yuichi Sei
Published in: Progress in Informatics (2008-03-01)

The engineering of security is an essential discipline in software engineering. It requires one to embrace a holistic approach, as any weakness along the engineering process of the system may lead to future security breaches. It is in general difficult to achieve and becomes particularly acute in wireless sensor networks, owing to the stringent limitations in communication and computational power. We survey the current state of the art on this topic and set forth issues that require further study. The analysis of current work covers general security issues of wireless sensor network research and discusses the present achievements for engineering security with regards to earlier surveys in this domain. We also cover security capabilities of major implementation platforms, namely TinyOS and Sun SPOT TM , and present available and required mechanisms that will become essential for software engineers.
Challenges and Solutions for Addressing Software Security in Agile Software Development
Authors: Ronald Jabangwe, Kati Kuusinen, Klaus R Riisom, Martin Slusarczyk Hubel, Hasan M Alradhi, Niels Bonde Nielsen
Published in: International Journal of Systems and Software Security and Protection (2018-01-01)

There has been a surge in the number of software security threats and vulnerabilities in recent times. At the same time, expectations towards software and data security are growing. Thus, there is a need to ensure that security-related tasks are effectively integrated in the software development processes. However, integrating security practices with agile software development is not trivial due to, for instance, differences in process dynamics and the concentration on functional vs non-functional requirements. In this article, the authors present a literature review on the challenges and solutions when adopting security in an agile software development context. Their findings suggest that there are ongoing efforts to integrate security-practices in agile methods, but more research is needed to make the processes more optimized and simpler for developers. A rigor and relevance assessment on primary studies highlights a need for improving the manner in which studies on the topic are performed as well as reported.
Perceived significance of information security governance to predict the information security service quality in software service industry
Authors: Sanjay Bahl, O. P. Wali
Published in: Information Management & Computer Security (2014-01-24)

Purpose – Information security is a growing concern in society, across businesses and government. As the offshore IT services market continues to grow providing numerous benefits, there are also perceived risks with respect to the quality of information security delivered in the supply chain. This paper aims to examine, as a case, the perceptions of Indian software services provider (service provider) employees with respect to information security governance and its impact on information security service quality that is delivered to customers. Design/methodology/approach – The paper provides a framework built upon the existing dimensions and instruments for total quality management and service quality, suitably modified to reflect the context of information security. SmartPLS, a structural equation modelling technique, has been used to analyse field survey data collected from across various Indian cities and companies. Findings – Significant finding is that information security governance in an IT outsourcing company providing software services has a highly significant impact on the information security service quality, which can be predicted. The paper also establishes that there is a positive relationship collectively between elements of information security governance and information security service quality. Research limitations/implications – Since data used in this study were taken solely from the responses of employees of outsourced service companies in India, it does not show if this translates into service improvements as perceived by the customer. Practical implications – Information security governance should be made an integral part of corporate governance and is an effective strategic technique, if software outsourcing business enterprises want to achieve a competitive edge, provide client satisfaction and create trust. Originality/value – The paper presents empirical data validation of the connection between information security governance and quality of service.
Enhancing Security and Sustainability of e-Learning Software Systems: A Comprehensive Vulnerability Analysis and Recommendations for Stakeholders
Authors: Souheil Abdel-Latif Akacha, Ali Ismail Awad
Published in: Sustainability (2023-09-24)

The onset of the COVID-19 pandemic prompted educational institutions to swiftly integrate e-learning software systems, including learning management systems (LMSs), as essential tools for online education. This study aims to probe the inherent security vulnerabilities of three widely utilized e-learning platforms, namely, Moodle, Chamilo, and Ilias, spanning the pre-pandemic, pandemic, and post-pandemic periods. The rapid adoption of these platforms during the pandemic revolutionized online education but also unveiled security risks. This paper delves into these security vulnerabilities, offering insights before, during, and after the pandemic. Through an analysis of existing patches and security measures, areas for improvement are identified. Furthermore, the paper considers emerging cybersecurity technologies and trends, providing comprehensive recommendations to enhance system resilience against evolving cyber threats. The results obtained here can provide educational institutions with a guide for action to enable effective mitigation of e-learning software security vulnerabilities and ensure the continued security and sustainability of online education systems.
Enhancing software security with blockchain integration for decentralized and tamper-proof application architectures
Authors: Adeola Mercy Osilaja, Azeezat Raheem, Enuma Edmund
Published in: World Journal of Advanced Research and Reviews (2024-12-30)

The increasing prevalence of cyber threats and data breaches has highlighted the critical need for secure and resilient software architectures. Blockchain technology, with its decentralized and tamper-proof properties, offers a transformative approach to enhancing software security. This paper explores the integration of blockchain into software systems to create decentralized, transparent, and secure application architectures. By leveraging blockchain’s capabilities, such as immutable data storage, distributed consensus, and cryptographic integrity, developers can address vulnerabilities in centralized systems and ensure robust protection against unauthorized access and tampering. The study begins by analysing current challenges in software security, including risks posed by centralized data repositories, inadequate access control, and vulnerability to cyberattacks. It then examines blockchain’s core principles and their applicability to software development, such as its ability to authenticate users, verify transactions, and secure sensitive data. Use cases, including secure supply chain management, decentralized identity systems, and blockchain-enabled IoT networks, demonstrate the practical benefits of integrating blockchain into software infrastructures. While blockchain offers significant advantages, the paper also addresses key challenges, such as scalability, energy consumption, and integration complexity. Strategies for overcoming these barriers, including the use of layer-2 solutions and hybrid blockchain models, are discussed. The paper concludes by presenting a vision for the future of secure software architectures that combine blockchain with emerging technologies like artificial intelligence and zero-trust security frameworks. This research provides actionable insights for software architects and developers seeking to enhance application security through blockchain integration, paving the way for more resilient and trustworthy systems in an increasingly interconnected digital landscape.
Design and Development of Artificial Intelligence Knowledge Processing System for Optimizing Security of Software System
Authors: Raghavendra Rao Althar, Debabrata Samanta, Sathvik Purushotham, Sandeep Singh Sengar, Chaminda Hewage
Published in: SN Computer Science (2023-04-15)

Abstract Software security vulnerabilities are significant for the software development industry. Exploration is conducted for software development industry landscape, software development eco-system landscape, and software system customer landscape. The focus is to explore the data sources that can provide the software development team with insights to act upon the security vulnerabilities proactively. Across these modules of software landscape, customer landscape, and industry landscape, data sources are leveraged using artificial intelligence approaches to identify the security insights. The focus is also on building a smart knowledge management system that integrates the information processed across modules into a central system. This central intelligence system can be further leveraged to manage software development activities proactively. In this exploration, machine learning and deep learning approaches are devised to model the data and learn from across the modules. Architecture for all the modules and their integration is also proposed. Work helps to envision a smart system for Artificial Intelligence-based knowledge management for managing software security vulnerabilities.
A Systematic Approach to Threat Modeling and Security Analysis for Software Defined Networking
Authors: Taehoon Eom, Jin B. Hong, Seongmo An, Jong Sou Park, Dong Seong Kim
Published in: IEEE Access (2019-01-01)

Software Defined Networking (SDN) extends capabilities of existing networks by providing various functionalities, such as flexible networking controls. However, there are many security threat vectors in SDN, including existing and emerging ones arising from new functionalities, that may hinder the use of SDN. To tackle this problem, many countermeasures have been developed to mitigate various threats faced in SDN. However, their effectiveness must be analyzed and compared to fully understand how security posture of SDN changes when the countermeasure is adopted. Also, it becomes difficult to optimize the security of SDN without using a systematic approach to evaluate the security posture of SDN. In this paper, we propose a novel framework to systematically model and analyze the security posture of SDN. We develop a novel graphical security model formalism named Threat Vector Hierarchical Attack Representation Model (TV-HARM), which provides a systematic approach to evaluate threats, attacks and countermeasures for SDN. The TV-HARM captures different threats and their combinations, enabling security risk assessment of SDN. In addition, we define three new security metrics to represent security of SDN. Our experimental results showed that the proposed security assessment framework can capture and evaluate various security threats to SDN, demonstrating the applicability and feasibility of the proposed framework.
A Novel Security Survival Model for Quantum Key Distribution Networks Enabled by Software-Defined Networking
Authors: Omar Shirko, Shavan Askar
Published in: IEEE Access (2023-01-01)

Quantum-key-distribution (QKD) networks can theoretically generate quantum secret keys that are completely secure for an entire communication system. The rate of key distribution is low and decreases exponentially with increasing distance. A classic trusted relay (CTR) uses additional keys to enhance security distance in QKD networks. In practice, the assurance of security for certain relay nodes is still lacking, despite the fact that CTR requires that all nodes be trusted. Owing to channel unreliability, system faults accumulate during the key relay, thereby increasing the probability of CTR failing to distribute the secret key. The failure of a successful key relay would then result in the subsequent destruction of all the keys involved in the process, which leads to the wasting of the quantum secret key and reduction system encryption. Accordingly, reducing the impact of CTR failures and realising the key security distribution of remote quantum networks have become new challenges that require the development of a new survivability scheme. In this study, a software-defined networking (SDN) technique is introduced to circumvent this drawback by utilising the flexibility provided by the SDN paradigm for better QKD network management efficiency. In particular, a novel survivability model called software-defined quantum key relay failure (SDQKRF) is proposed in this paper in which a new function is developed and added to the SDN controller. According to the simulation results, SDN over a QKD network using the SDQKRF model is more reliable and performs better in terms of the key generation ratio, key utilisation rate, recovery after failure, avalanche effect, and service blocking rate than a regular QKD network without the SDQTRF model.
A survey on blockchain technology and its security
Authors: Huaqun Guo, Xingjie Yu
Published in: Blockchain Research and Applications (2022-02-24)

Blockchain is a technology that has desirable features of decentralization, autonomy, integrity, immutability, verification, fault-tolerance, anonymity, auditability, and transparency. In this paper, we first carry out a deeper survey about blockchain technology, especially its history, consensus algorithms' quantitative comparisons, details of cryptography in terms of public key cryptography, Zero-Knowledge Proofs, and hash functions used in the blockchain, and the comprehensive list of blockchain applications. Further, the security of blockchain itself is a focus in this paper. In particular, we assess the blockchain security from risk analysis to derive comprehensive blockchain security risk categories, analyze the real attacks and bugs against blockchain, and summarize the recently developed security measures on blockchain. Finally, the challenges and research trends are presented to achieve more scalable and securer blockchain systems for the massive deployments.
Hardware Security in IoT Devices with Emphasis on Hardware Trojans
Authors: Simranjeet Sidhu, Bassam J. Mohd, Thaier Hayajneh
Published in: Journal of Sensor and Actuator Networks (2019-08-10)

Security of IoT devices is getting a lot of attention from researchers as they are becoming prevalent everywhere. However, implementation of hardware security in these devices has been overlooked, and many researches have mainly focused on software, network, and cloud security. A deeper understanding of hardware Trojans (HTs) and protection against them is of utmost importance right now as they are the prime threat to the hardware. This paper emphasizes the need for a secure hardware-level foundation for security of these devices, as depending on software security alone is not adequate enough. These devices must be protected against sophisticated attacks, especially if the groundwork for the attacks is already laid in devices during design or manufacturing process, such as with HTs. This paper will discuss the stealthy nature of these HT, highlight HT taxonomy and insertion methods, and provide countermeasures.
Software Defined Radio: Challenges and Opportunities
Authors: Tore Ulversøy
Published in: IEEE Communications Surveys & Tutorials (2010-01-01)

Software Defined Radio (SDR) may provide flexible, upgradeable and longer lifetime radio equipment for the military and for civilian wireless communications infrastructure. SDR may also provide more flexible and possibly cheaper multi-standard-terminals for end users. It is also important as a convenient base technology for the future context-sensitive, adaptive and learning radio units referred to as cognitive radios. SDR also poses many challenges, however, some of them causing SDR to evolve slower than otherwise anticipated. Transceiver development challenges include size, weight and power issues such as the required computing capacity, but also SW architectural challenges such as waveform application portability. SDR has demanding implications for regulators, security organizations and business developers.
Significance of Security Metrics in Secure Software Development
Authors: Shams Tabrez Siddiqui
Published in: International Journal of Applied Information Systems (2017-09-09)

With increasing advancement of technology in the past years rise various security issues and problems. In this connected world, security is a paramount and challenging issue in software development and is the demand of time. However usually engineers/developers think about it after the development of the entire software and at that it's too late. Though, the software developers are aware of the importance of security and its priority throughout software development life cycle. Considering the security challenging issues right from the early stages of software development and incorporating it during software development indicates good research and development.
Software-as-a-Service Security Challenges and Best Practices: A Multivocal Literature Review
Authors: Mamoona Humayun, Mahmood Niazi, Maram Fahhad Almufareh, N. Z. Jhanjhi, Sajjad Mahmood, Mohammad Alshayeb
Published in: Applied Sciences (2022-04-13)

Cloud computing (CC) is the delivery of computing services on demand and is charged using a “pay per you use” policy. Of the multiple services offered by CC, SaaS is the most popular and widely adapted service platform and is used by billions of organizations due to its wide range of benefits. However, security is a key challenge and obstacle in cloud adoption and therefore needs to be addressed. Researchers and practitioners (R&amp;P) have discussed various security challenges for SaaS along with possible solutions. However, no research study exists that systematically accumulates and analyzes the security challenges and solutions. To fill this gap and provide the state-of-the-art (SOTA) picture of SaaS security, this study provides a comprehensive multivocal literature review (MVLR), including SaaS security issues/challenges and best practices for mitigating these security issues. We identified SaaS security issues/challenges and best practices from the formal literature (FL) as well as the grey literature (GL) to evaluate whether R&amp;P is on the same page or if controversies exist. A total of 93 primary studies were identified, of which 58 are from the FL and 35 belong to the GL. The studies are from the last ten years, from 2010 to 2021. The selected studies were evaluated and analyzed to identify the key security issues faced by SaaS computing and to be aware of the best practices suggested by R&amp;P to improve SaaS security. This MVLR will assist SaaS users to identify the many areas in which additional research and development in SaaS security is required. According to our study findings, data breaches/leakage, identity and access management, governance and regulatory compliance/SLA compliance, and malicious insiders are the key security challenges with the maximum frequency of occurrence in both FL and GL. On the other hand, R&amp;P agree that up-to-date security controls/standards, the use of strong encryption techniques, regulatory compliance/SLA compliance, and multifactor authentication are the most important solutions.
Security risks in the software development lifecycle: A review
Authors: David Odera, Martin Otieno, Jairus Ekume Ounza
Published in: World Journal of Advanced Engineering Technology and Sciences (2023-04-08)

Software security is one of the most critical concerns in modern software development, especially in safety-critical systems whose failure can lead to environmental damage, substantial property, or loss of human lives. In addition, flawed applications have been shown to exhibit unpredictable behavior while software products with numerous vulnerabilities present attack vectors that can be exploited by attackers. To address some of these problems, vulnerability prediction has been deployed for early detection of security risks in the software development lifecycle (SDLC). This can potentially facilitate decision making during the SDLC, resulting in the production of more secure software. Prioritizing security during SDLC permits developers and stakeholders to identify and resolve possible security concerns early on in the process. The aim of this paper is therefore to offer some in-depth review of software systems security issues. In addition, the various measures that have been put in place to mitigate security issues during SDLC are discussed.