Managing security debt across PLC phases in a VSE context

Abstract

Nowadays, security and safety aspects are two of the major concerns for any software system development, especially while developing safety critical systems. This is especially relevant for very small entities because they have a limited amount of resources for dealing with all these aspects at the same time. In addition, these systems are highly regulated domains, and they involve a huge set of standards focused on safety and security‐related issues. Therefore, these small entities are not only facing hurdles related to technical aspects but also from the so‐called technical debt when overarching a critical development. This paper extends the assurance cases approach by integrating security aspects within the life cycle, and it proposes a framework for managing the associated security technical debt for very small entities. A tool chain is outlined, and the approach is illustrated with an industrial use case.

A privacy preserving approach for avoiding database recovery attacks in software developments

“…However, there are too few proposals focused on how to improve privacy preserving techniques within the umbrella of VSEs. To date, we have been proposing how to increase security within their software developments [8], and on to integrate them in small settings [9], but we have left aside how to include and enhance privacy within their developments.…”

“…There are several studies on ISO/IEC 29110 where it is highlighted the increasing interest in this standard [7]. In fact, some research works are focused on how to increase security in these settings [8], and on the integration of security practices in the standard [9].…”