Safety Critical Software and Security - How Low Can You Go?

Abstract

The safety of aviation software is ensured by performing development according to the DO-178C standard. However, this standard has a blind spot in that it fails to consider software security aspects in development. The Building Security In Maturity Model (BSIMM) comprises a software security framework with 113 software security activities. This model is often used for measuring the maturity of an organization's software security lifecycle. In this paper we evaluate the ability of DO-178C to ensure also software security, by demonstrating how few BSIMM activities you can get away with performing, while remaining compliant with the different DO-178C assurance levels. The results indicate that organizations with very low software security maturity can still be able to perform well in accordance to DO-178C. Based on the results, we propose concrete activities that could be integrated into the DO-178C development process, to strengthen the security of the developed software.

Secure Software Development Lifecycle: A Case for Adoption in Software Smes

“…The Building Security in Maturity Model (BSIMM) is a descriptive model of activities for evaluating and assessing software security initiatives [30]- [32]. BSIMM comprises 122 software security activities grouped into 12 practices and organized into four domains: governance, intelligence, secure software development (SSDL), and deployment [33].…”

“…BSIMM comprises 122 software security activities grouped into 12 practices and organized into four domains: governance, intelligence, secure software development (SSDL), and deployment [33]. BSIMM is best used as a yardstick for measuring other secure software development frameworks or comparing an organization's software security initiatives against others [30]- [32].…”

Exploring the Need for a CERT for the Norwegian Construction Sector

“…This paper intends to provide an understanding of how great the need for a common collaborative security environment for the construction sector is, and what services are needed in the industry. The paper is based on interviews and a review of relevant literature and documents, along with the authors' general competence and expertise in ICT security [4,1,9,10]. Seven interviews have been conducted with experts with security responsibilities from the construction sector.…”