Security by Design in Software Engineering

Abstract

Security is a non-functional requirement difficult-to-handle during software development. However, it appears to be common in software engineering, that security is taken care of during the design- and test-phase only. If security is neglected during the implementation phase, flaws will be introduced. Those may be - if at all - found during testing where the cost-to-fix is higher as if found during the implementation phase. Hence, this research proposal suggests to investigate the extent to which code analysis tools can be used as a step towards continuous security inspection in software engineering projects. By automating security testing in development flaws can be found as soon as they are introduced. This could greatly reduce the cost to fix flaws and help building more secure software.

Secure Software Engineering: A Knowledge Modeling based Approach for Inferring Association between Source Code and Design Artifacts

“…Table III depicts the possible threats identified by the threat modeling process. Similarly, through static code analysis, A2, A5, and A6 categories 3 of OWASP have captured. The results produced from the threat modeling process and the static code analysis provided as input to find the association between them.…”

“…Having identified the critical need for software security, the paradigm shift of "Building Security In" has emerged in the recent decades [1], [2], [3]. This paradigm shift requires software security to be addressed in all phases of the software development lifecycle.…”

The European framework for cybersecurity: strong assets, intricate history

“…Software engineering processes have been shown to reduce the probability and mitigate the severity of exploitable weaknesses when applied carefully [31]. However, the ubiquity of exploitable vulnerabilities in software, the pervasiveness of automatic updates, and their increasing frequency show how difficult it is to achieve those objectives.…”

Secure Consensus via Objective Coding: Robustness Analysis to Channel Tampering

“…In this work, we take a different point of view: instead of developing tools to secure existing systems, we provide inherently secure embedded measures that guarantee robust consensus convergence. With this paper, we start to expand the secure-by-design philosophy popular in software engineering [18] towards the design of multi-agent consensus. The research proposed here is thus not meant to replace usual security measures-we assume that these measures have been taken-but to aim to devise a lower level layer of security.…”