Systematic Literature Review on Security Risks and its Practices in Secure Software Development

Abstract

Security is one of the most critical aspects of software quality. Software security refers to the process of creating and developing software that assures the integrity, confidentiality, and availability of its code, data, and services. Software development organizations treat security as an afterthought issue, and as a result, they continue to face security threats. Incorporating security at any level of the Software Development Life Cycle (SDLC) has become an urgent requirement. Several methodologies, strategies, and models have been proposed and developed to address software security, but only a few of them give reliable evidence for creating secure software applications. Software security issues, on the other hand, have not been adequately addressed, and integrating security procedures into the SDLC remains a challenge. The major purpose of this paper is to learn about software security risks and practices so that secure software development methods can be better designed. A systematic literature review (SLR) was performed to classify important studies to achieve this goal. Based on the inclusion, exclusion, and quality assessment criteria, a total of 121 studies were chosen. This study identified 154 security risks and 424 best practices that help software development organizations to manage the security in each phase of the SDLC. To pursue secure SDLC, this study prescribed different security activities, which should be followed in each phase of the SDLC. Successful integration of these activities minimizing effort, time, and budget while delivering secure software applications. The findings of this study assist software development organizations in improving the security level of their software products and also enhancing their security efficiency. This will raise the developer's awareness of secure development practices as well.

Evaluation of Requirement Engineering Best Practices for Secure Software Development in GSD: An ISM Analysis

“…Step 1: To investigate SRE strategies to help GSD organizations and practitioners manage SSD RE operations. Thereby, we performed a systematic literature review (SLR) approach and the preliminary findings of our published prior work [4].…”

“…Step 2: A questionnaire survey to verify and validate the categorization of security best practices of RE for GSD as identified through SLR [4].…”

“…Large corporations have lost millions of dollars due to security breaches, and this cost is rising [18]. According to Khan et al [4], early security requirements analysis can cut software development and maintenance costs by 12-21%. Previous studies by academia, industry, and standards groups have proposed solutions to these issues [7,19].…”

“…Integrating security into the software engineering paradigm is essential to secure the software development life cycle from its early stages [4]. Therefore, many researchers have considered security from the outset of software development, starting with requirement engineering (RE) [5].…”

Improving the Safety and Security of Software Systems by Mediating SAP Verification

“…Every day, hackers and cybercriminals are coming up with new methods to take advantage of software flaws. Security should be a priority throughout the SDLC, allowing developers and stakeholders to identify and resolve possible security concerns early on in the process [11,12]. Therefore, it is necessary to adopt the concept of SSDLC, as shown in Figure 1.…”