Awareness and Working Knowledge of Secure Design Principles: A User Study

Almousa, May; Keshavarz, Mahsa; Anwar, Mohd

doi:10.1007/978-3-030-50309-3_1

Cited by 1 publication

(5 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The list of concerns was presented by software security professionals who had contributed to both real-world data and expertise. To test their familiarity and working knowledge of SDPs, Almousa et al [6] surveyed participants who had experience in designing or developing software, exploring if the demographic variables were associated with their knowledge of SDPs. They also discovered misconceptions about SDPs and gathered participants' opinions on the ways to implement SDPs.…”

Section: Related Workmentioning

confidence: 99%

“…However, these studies have two important limitations in comparison to the present study: (a) they did not focus on all SDPs but rather one or two principles, while this study addresses most if not all SDPs; (b) their studies were applied not on a software level but on a hardware or network level. This paper aims to fill this gap by applying SDPs to a real-world example in an effort to improve the understanding of software designers and developers of SDPs, though the understanding itself is another challenge [6].…”

Section: Related Workmentioning

confidence: 99%

“…The principle of separation of privileges is restrictive because it limits access to system entities [6]. This principle is applied to ePS by prohibiting one user to work with more than one role simultaneously.…”

Section:  Separation Of Privilegesmentioning

confidence: 99%

“…Software developers are expected to comply secure design principles (SDPs) that recommend best practices in the implementation of security metrics in a system [6]. Because they aim to improve security and reduce threats, SDPs are employed to be a solution to security problems of all system types: Software systems, hardware systems, network systems, or Internet of Things (IoT) systems.…”

Section: Introductionmentioning

confidence: 99%

“…Practically, if the software developers implement these SDPs, their systems are expected to be secured against different attacks. Unfortunately, there is a knowledge gap in SDPs; software developers and designers do not know how to apply and follow SDPs in the system design phase [6]. The developers and designers rely on searching the internet and browsing e-books whenever they face security issues [7].…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Exploring How to Apply Secure Software Design Principles

Ebad

2022

IEEE Access

View full text Add to dashboard Cite

Secure design principles (SDPs) are employed to be a solution against many types of attacks. However, it has been shown that software developers are not familiar with the notion of SDPs or do not know how to implement them in the design stage. This paper tries to bridge this gap by applying SDPs to a real-world software project, electronic promotion system (ePS), and commenting on the contribution of each SDP. Saltzer and Schroeder's eight principles, along with three additional principles proposed by others, are chosen to be applied to ePS. The results indicate that most of the principles enumerated here were instrumental and applied in the ePS's design. Most of the eleven SDPs, economy of mechanism, fail-safe defaults, least privilege, least common mechanisms, sound authentication, defense in depth, and input validation were implemented on ePS to a great extent. Others, namely separation of privileges and psychological acceptability, were applied to a limited extent. The remaining two principles, complete mediation and open design, did not play a vital role, as ePS by itself satisfies these two principles. Some contradictions and interrelations among the SDPs when they were applied were also debated. Taking into account the integration of ePS with other enterprise systems in the same organization, it was felt placing SDPs in a general context would be beneficial and sufficient. This work will bridge the gap between software practitioners and state-of-the-art research on software SDPs.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section:  Separation Of Privilegesmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations