Sökning: onr:"swepub:oai:research.chalmers.se:70304c60-1b37-42e4-a39f-acff54aca081" >
Automating the earl...
Automating the early detection of security design flaws
-
- Tuma, Katja, 1991 (författare)
- Gothenburg University,Göteborgs universitet,Institutionen för data- och informationsteknik (GU),Department of Computer Science and Engineering (GU)
-
- Sion, Laurens (författare)
- Katholieke Universiteit Leuven
-
- Scandariato, Riccardo, 1975 (författare)
- Gothenburg University,Göteborgs universitet,Institutionen för data- och informationsteknik (GU),Department of Computer Science and Engineering (GU)
-
visa fler...
-
- Yskout, Koen (författare)
- Katholieke Universiteit Leuven
-
visa färre...
-
(creator_code:org_t)
- 2020-10-16
- 2020
- Engelska.
-
Ingår i: Proceedings - 23rd ACM/IEEE International Conference on Model Driven Engineering Languages and Systems, MODELS 2020. - New York, NY, USA : ACM. ; :MODELS '20, s. 332-342
- Relaterad länk:
-
https://research.cha...
-
visa fler...
-
https://doi.org/10.1...
-
https://research.cha...
-
https://gup.ub.gu.se...
-
visa färre...
Abstract
Ämnesord
Stäng
- Security by design is a key principle for realizing secure software systems and it is advised to hunt for security flaws from the very early stages of development. At design-time, security analysis is often performed manually by means of either threat modeling or expert-based design inspections. However, when leveraging the wide range of established knowledge bases on security design flaws (e.g., CWE, CAWE), these manual assessments become too time consuming, error-prone, and infeasible in the context of contemporary development practices with frequent iterations. This paper focuses on design inspection and explores the potential for automating the application of inspection rules to speed up the security analysis. The contributions of this paper are: (i) the creation of a publicly available data set consisting of 26 design models annotated with security flaws, (ii) an automated approach for following inspection guidelines using model query patterns, and (iii) an empirical comparison of the results from this automated approach with those from manual inspection. Even though our results show that a complete automation of the security design flaw detection is hard to achieve, we find that some flaws (e.g., insecure data exposure) are more amenable to automation. Compared to manual analysis techniques, our results are encouraging and suggest that the automated technique could guide security analysts towards a more complete inspection of the software design, especially for large models.
Ämnesord
- NATURVETENSKAP -- Data- och informationsvetenskap -- Annan data- och informationsvetenskap (hsv//swe)
- NATURAL SCIENCES -- Computer and Information Sciences -- Other Computer and Information Science (hsv//eng)
- TEKNIK OCH TEKNOLOGIER -- Annan teknik -- Övrig annan teknik (hsv//swe)
- ENGINEERING AND TECHNOLOGY -- Other Engineering and Technologies -- Other Engineering and Technologies not elsewhere specified (hsv//eng)
- NATURVETENSKAP -- Data- och informationsvetenskap -- Systemvetenskap, informationssystem och informatik (hsv//swe)
- NATURAL SCIENCES -- Computer and Information Sciences -- Information Systems (hsv//eng)
- NATURVETENSKAP -- Data- och informationsvetenskap -- Programvaruteknik (hsv//swe)
- NATURAL SCIENCES -- Computer and Information Sciences -- Software Engineering (hsv//eng)
Nyckelord
- design flaw detection
- empirical software engineering
- security flaw
- secure design
- security-by-design
- automation
- security-by-design
- secure design
- security flaw
- design flaw detection
- automation
- empirical software engineering
Publikations- och innehållstyp
- kon (ämneskategori)
- ref (ämneskategori)