Security Threat and Vulnerability Assessment and Measurement in Secure Software Development  

作　　者：Mamoona Humayun NZ Jhanjhi Maram Fahhad Almufareh Muhammad Ibrahim Khalil 

机构地区：[1]Department of Information Systems,College of Computer and Information Sciences,Jouf University,Al-Jouf,KSA [2]School of Computer Science and Engineering(SCE),Taylor’s University,Selangor,Malaysia [3]Department of Computer Science,Bahria University,Islamabad,Pakistan

出　　处：《Computers, Materials & Continua》2022年第6期5039-5059,共21页计算机、材料和连续体（英文）

摘　　要：Security is critical to the success of software,particularly in today’s fast-paced,technology-driven environment.It ensures that data,code,and services maintain their CIA(Confidentiality,Integrity,and Availability).This is only possible if security is taken into account at all stages of the SDLC(Software Development Life Cycle).Various approaches to software quality have been developed,such as CMMI(Capabilitymaturitymodel integration).However,there exists no explicit solution for incorporating security into all phases of SDLC.One of the major causes of pervasive vulnerabilities is a failure to prioritize security.Even the most proactive companies use the“patch and penetrate”strategy,inwhich security is accessed once the job is completed.Increased cost,time overrun,not integrating testing and input in SDLC,usage of third-party tools and components,and lack of knowledge are all reasons for not paying attention to the security angle during the SDLC,despite the fact that secure software development is essential for business continuity and survival in today’s ICT world.There is a need to implement best practices in SDLC to address security at all levels.To fill this gap,we have provided a detailed overview of secure software development practices while taking care of project costs and deadlines.We proposed a secure SDLC framework based on the identified practices,which integrates the best security practices in various SDLC phases.A mathematical model is used to validate the proposed framework.A case study and findings show that the proposed system aids in the integration of security best practices into the overall SDLC,resulting in more secure applications.

关 键 词：SECURITY secure software development software development life cycle(SDLC) CONFIDENTIALITY INTEGRITY AVAILABILITY 

分 类 号：TP309[自动化与计算机技术—计算机系统结构] TP311.5[自动化与计算机技术—计算机科学与技术]