Agile Software Development

Abstract

In this article, the authors contrast the results of a series of interviews with agile software development organizations with a case study of a distributed agile development effort, focusing on how information security is taken care of in an agile context. The interviews indicate that small and medium-sized agile software development organizations do not use any particular methodology to achieve security goals, even when their software is web-facing and potential targets of attack. This case study confirms that even in cases where security is an articulated requirement, and where security design is fed as input to the implementation team, there is no guarantee that the end result meets the security objectives. The authors contend that security must be built as an intrinsic software property and emphasize the need for security awareness throughout the whole software development lifecycle. This paper suggests two extensions to agile methodologies that may contribute to ensuring focus on security during the complete lifecycle.

OWASP Top 10 - Do Startups Care?

“…Consistent with the Errata survey, Nicolaysen et al [9] found that very few of the companies were utilizing methodologies for creating secure software. The developers had no formal training in developing secure software and very few were concerned about security.…”

“…Two studies have recently been conducted to determine the state of practice in Norwegian organizations with regard to security. Nicolaysen et al [9] studied the software security initiatives of six companies using agile software development methodologies and Jaatun et al [10] studied 20 public Norwegian organizations developing software.…”

Quality Requirement Documentation Guidelines for Agile Software Development

“…d) ASD teams can assist customers in recognizing the importance and value of QRs, since customers in some domains may overlook important QRs or may not have adequate knowledge about QRs [40]. For instance, customers in the energy domain may overlook important QRs such as security [41]. Related Work: [5], [6], [8], [10], [30], [38]- [41] 2) RECOGNIZE THE NEED FOR OPTIMAL DOCUMENTATION OF QRs Description: Agile teams should acknowledge the need for optimal documentation of QRs (i.e., a satisfactory level of QR documentation that will not compromise agility and product quality).…”

“…For instance, customers in the energy domain may overlook important QRs such as security [41]. Related Work: [5], [6], [8], [10], [30], [38]- [41] 2) RECOGNIZE THE NEED FOR OPTIMAL DOCUMENTATION OF QRs Description: Agile teams should acknowledge the need for optimal documentation of QRs (i.e., a satisfactory level of QR documentation that will not compromise agility and product quality). They should take actions to meet the need for optimal documentation of QRs and start documenting QRs at early stages.…”

“…At times QRs such as security may not receive adequate attention compared with other functional requirements in sprint backlogs [60]. Utilizing a distinct backlog to document specific QRs can help to give more focus to QRs [41].…”