Security assurance during the software development cycle

Security assurance cases—state of the art of an emerging approach

“…-Integrating SAC in the development life-cycle: These approaches suggest mapping the SAC creation activities to the development activities to integrate SACs in the development and security processes (Agudo et al 2009;Ben Othmane et al 2014; Ray and (Sklyar and Kharchenko 2016, 2017a, b, 2019. In general, these approaches suggest that the different stages of software development (requirements, design, implementation, and deployment) correspond to different abstraction levels of the security claims that can be made on the system.…”

“…Each level of the argumentation could be done with a specific strategy. Hence, one SAC might have one or more argumentation strategies as is the case in some of the included studies in this SLR, e.g., Agudo et al (2009) and Mohammadi et al (2018).…”

“…When regarding argumentation strategies in the context of the different approaches, we could not find any correlation between the two. For instance, different approaches which integrate SAC within the development life-cycle use different argumentation strategies (e.g., requirements Agudo et al 2009 and development phases Ray and Cleaveland 2015). The most common strategy depends on the output of a threat, vulnerability, asset or risk analysis (8 papers) (Cockram and Lautieri 2007;Coffey et al 2014;Cyra and Gorski 2007;Mohammadi et al 2018;Patu and Yamamoto 2013a;Vivas et al 2011;Xu et al 2017;Weinstock et al 2007).…”

“…The most common strategy depends on the output of a threat, vulnerability, asset or risk analysis (8 papers) (Cockram and Lautieri 2007;Coffey et al 2014;Cyra and Gorski 2007;Mohammadi et al 2018;Patu and Yamamoto 2013a;Vivas et al 2011;Xu et al 2017;Weinstock et al 2007). Other popular strategies are breaking down the claims based on the requirements or more specifically quality requirements and even more specifically security requirements (5 papers) (Agudo et al 2009;Calinescu et al 2017;Haley et al 2005;Netkachova et al 2015;Sklyar and Kharchenko 2017b), and arguing based on security properties, e.g., confidentiality, integrity and availability (5 papers) (Chindamaikul et al 2014;Finnegan and McCaffery 2014a;Mohammadi et al 2018;Poreddy and Corns 2011;Sklyar and Kharchenko 2017b). Additionally, researchers also used system and security goals (4 papers) (Agudo et al 2009;Ben Othmane et al 2014;Mohammadi et al 2018;Tippenhauer et al 2014)…”

“…The most common types of evidence reported in literature are test results (TR) (12 papers) (Ben Othmane and Ali 2016; Calinescu et al 2017;Cheah et al 2018;Chindamaikul et al 2014;Lipson and Weinstock 2008;Poreddy and Corns 2011;Shortt and Weber 2015;Sklyar and Kharchenko 2016, 2017a, b, 2019Sljivo and Gallina 2016) and different types of analysis. These analysis include threat and vulnerability (TVA) (Cockram and Lautieri 2007;McCaffery 2014a, b, Patu andYamamoto 2013a), code (CA) and bug (BA) (Chindamaikul et al 2014;Ben Othmane and Ali 2016;Sklyar and Kharchenko 2016, 2017a, b, 2019, security standards and policies (PA) (Agudo et al 2009;Netkachova et al 2015), risk (RA) (Mohammadi et al 2018), and log analysis (LA) (Mohammadi et al 2018;Patu and Yamamoto 2013a). Cheah et al (2018) present a classification of security test results using security severity ratings.…”