research-article

Surveying Secure Software Development Practices in Finland

Authors:

Jukka Ruohonen,

Sami HyrynsalmiAuthors Info & Claims

ARES '18: Proceedings of the 13th International Conference on Availability, Reliability and Security

Article No.: 6, Pages 1 - 7

https://doi.org/10.1145/3230833.3233274

Published: 27 August 2018 Publication History

Abstract

Combining security engineering and software engineering is shaping the software development processes and shifting the emphasis of information security from the operation environment into the main information asset: the software itself. To protect software and data assets, software development is subjected to an increasing amount of external regulation and organizational security requirements. To fulfill these requirements, the practitioners producing secure software have plenty of models, guidelines, standards and security instructions to follow, but very little scientific knowledge about effectiveness of the security they take.

In this paper, we present the current state of security engineering surveys and present results from our industrial survey (n = 62) performed in early 2018. The survey was conducted among selected software and security professionals employed by a selected set of 303 Finnish software companies. Results are compared to a commercial survey, the BSIMM version 8 and the similarities and distinct differences are discussed. Also, an analysis of the composition of security development life cycle models is presented, suggesting regulation to be the driving force behind security engineering in software industry.

References

[1]

Ross J. Anderson. 2008. Security Engineering: A Guide to Building Dependable Distributed Systems (2 ed.). Wiley Publishing.

Digital Library

[2]

K. Beck. 1999. Embracing change with extreme programming. Computer 32, 10 (Oct 1999), 70--77.

Digital Library

[3]

Edsger W. Dijkstra. 1982. Selected Writings on Computing: A Personal Perspective. Springer-Verlag.

Digital Library

[4]

DoD. 1983. TRUSTED COMPUTER SYSTEM EVALUATION CRITERIA. United States Department of Defence.

[5]

DoD. 1994. SOFTWARE DEVELOPMENT AND DOCUMENTATION. United States Department of Defence.

[6]

Michael Howard and Steve Lipner. 2006. The security development lifecycle. Vol. 8. Microsoft Press Redmond.

Digital Library

[7]

IEEE. 1990. IEEE Standard Glossary of Software Engineering Terminology. 1--84 pages.

[8]

ISO/IEC. 2001. ISO/IEC 9126. Software engineering -- Product quality. ISO/IEC.

[9]

ISO/IEC standard 21827. 2008. Information Technology -- Security Techniques -- Systems Security Engineering -- Capability Maturity Model (SSE-CMM). ISO/IEC.

[10]

Sherlock Licorish, Johannes Holvitie, Rodrigo Spinola, Sami Hyrynsalmi, Jim Buchan, Thiago Mendes, Steve MacDonnell, and Ville Leppänen. 2016. Adoption and Suitability of Software Development Methods and Practices - Results from a Multi-National Industry Practitioner Survey. In 2016 Asia-Pacific Software Engineering Conference (APSEC). IEEE.

[11]

Gary McGraw. 2006. Software Security: Building Security In. Addison-Wesley Professional.

Digital Library

[12]

Gary McGraw. 2012. Software Security. Datenschutz und Datensicherheit - DuD 36, 9 (01 Sep 2012), 662--665.

[13]

Gary McGraw, Sammy Migues, and Jacob West. 2017. Building Security In Maturity Model (BSIMM), version 8. Technical Report. BSIMM.

[14]

Microsoft. 2017. Security Development Lifecycle for Agile Development. (2017).

[15]

OECD. 2018. Government at a Glance 2017 -- Finland Country Fact Sheet. (2018). https://www.oecd.org/gov/gov-at-a-glance-2017-finland.pdf

[16]

Andy Oram. 2017. The Alarming State of Secure Coding Neglect: A Survey Reveals a Deep Divide Between Developer Aspirations for Security and Organizational Practices. (2017). O'Reilly Media, Inc. Referenced in 5th of May 2018: https://www.oreilly.com/ideas/the-alarming-state-of-secure-coding-neglect.

[17]

OWASP. 2017. Software Assurance Maturity Model. (2017). https://www.owasp.org/images/6/6f/SAMM_Core_V1-5_FINAL.pdf

[18]

Mary Poppendieck and Tom Poppendieck. 2003. Lean Software Development: An Agile Toolkit: An Agile Toolkit. Addison-Wesley.

Digital Library

[19]

Kalle Rindell, Sami Hyrynsalmi, and Ville Leppänen. {n. d.}. Case Study of Agile Security Engineering: Building Identity Management for a Government Agency. International Journal of Secure Software Engineering 8 ({n. d.}), 43--57. Issue 1.

Digital Library

[20]

Kalle Rindell, Sami Hyrynsalmi, and Ville Leppänen. 2015. Securing Scrum for VAHTI. In Proceedings of 14th Symposium on Programming Languages and Software Tools, Jyrki Nummenmaa, Outi Sievi-Korte, and Erkki Mäkinen (Eds.). University of Tampere, Tampere, Finland, 236--250.

[21]

P. Rodriguez, J. Markkula, M. Oivo, and K. Turula. 2012. Survey on agile and lean usage in Finnish software industry. In Proceedings of the 2012 ACM-IEEE International Symposium on Empirical Software Engineering and Measurement. 139--148.

Digital Library

[22]

Reijo M. Savola. 2017. Current Level of Cybersecurity Competence and Future Development: Case Finland. In Proceedings of the 11th European Conference on Software Architecture: Companion Proceedings (ECSA '17). ACM, New York, NY, USA, 121--124.

Digital Library

[23]

Stavros Stavru. 2014. A critical examination of recent industrial surveys on agile method usage. Journal of Systems and Software 94 (2014), 87--97.

[24]

Jose M. Such, Antonios Gouglidis, William Knowles, Gaurav Misra, and Awais Rashid. 2016. Information assurance techniques: Perceived cost effectiveness. Computers & Security 60 (2016), 117--133.

Digital Library

[25]

VAHTI 1/2013. 2013. Sovelluskehityksen tietoturvaohje. (2013). https://www.vahtiohje.fi/web/guest/vahti-1/2013-sovelluskehityksen-tietoturvaohje Referenced 8th Oct. 2017.

[26]

John Viega and Gary McGraw. 2002. Building Secure Software: How to Avoid Security Problems the Right Way (1st ed.). Addison-Wesley.

Digital Library

Cited By

Valdés-Rodríguez YHochstetter-Diez JDiéguez-Rebolledo MBustamante-Mora ACadena-Martínez R(2024)Analysis of Strategies for the Integration of Security Practices in Agile Software Development: A Sustainable SME ApproachIEEE Access10.1109/ACCESS.2024.337238512(35204-35230)Online publication date: 2024
https://doi.org/10.1109/ACCESS.2024.3372385
Baninemeh EToomey HLabunets KWagenaar GJansen S(2024)An Evaluation of the Product Security Maturity Model Through Case Studies at 15 Software Producing OrganizationsSoftware Business10.1007/978-3-031-53227-6_23(327-343)Online publication date: 9-Feb-2024
https://doi.org/10.1007/978-3-031-53227-6_23
Nayaka Sheetakallu Krishnaiah PNarayan DSutradhar K(2024)A survey on secure metadata of agile software development process using blockchain technologySecurity and Privacy10.1002/spy2.3427:2Online publication date: 7-Mar-2024
Show More Cited By

Recommendations

Aligning security objectives with agile software development
XP '18: Proceedings of the 19th International Conference on Agile Software Development: Companion

Success of software development process is defined by its ability to transform the business objectives into requirements, and further into features and functionality. In addition to business objectives, software development also has security objectives ...
Fitting Security into Agile Software Development

Security objectives in software development are increasingly convergent with the business objectives, as requirements for privacy and the cost of security incidents call for more dependable software products. The development of secure software is ...
Software Engineering Practices and Methods in the Game Development Industry
CHI PLAY '19 Extended Abstracts: Extended Abstracts of the Annual Symposium on Computer-Human Interaction in Play Companion Extended Abstracts

Applying current software engineering practices in the game development industry is a rapidly growing but under researched area. Whether game development studios align to traditional software engineering practices such as agile methodologies to develop ...

Comments

Please enable JavaScript to view thecomments powered by Disqus.

Information & Contributors

Information

Published In

cover image ACM Other conferences

ARES '18: Proceedings of the 13th International Conference on Availability, Reliability and Security

August 2018

603 pages

ISBN:9781450364485

DOI:10.1145/3230833

Copyright © 2018 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

In-Cooperation

Universität Hamburg: Universität Hamburg

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 27 August 2018

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article
Research
Refereed limited

Conference

ARES 2018

ARES 2018: International Conference on Availability, Reliability and Security

August 27 - 30, 2018

Hamburg, Germany

Acceptance Rates

ARES '18 Paper Acceptance Rate 128 of 260 submissions, 49%;

Overall Acceptance Rate 228 of 451 submissions, 51%

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

9
Total Citations
View Citations
347
Total Downloads

Downloads (Last 12 months)31
Downloads (Last 6 weeks)2

Reflects downloads up to 25 Nov 2024

Other Metrics

View Author Metrics

Citations

Cited By

Valdés-Rodríguez YHochstetter-Diez JDiéguez-Rebolledo MBustamante-Mora ACadena-Martínez R(2024)Analysis of Strategies for the Integration of Security Practices in Agile Software Development: A Sustainable SME ApproachIEEE Access10.1109/ACCESS.2024.337238512(35204-35230)Online publication date: 2024
https://doi.org/10.1109/ACCESS.2024.3372385
Baninemeh EToomey HLabunets KWagenaar GJansen S(2024)An Evaluation of the Product Security Maturity Model Through Case Studies at 15 Software Producing OrganizationsSoftware Business10.1007/978-3-031-53227-6_23(327-343)Online publication date: 9-Feb-2024
https://doi.org/10.1007/978-3-031-53227-6_23
Nayaka Sheetakallu Krishnaiah PNarayan DSutradhar K(2024)A survey on secure metadata of agile software development process using blockchain technologySecurity and Privacy10.1002/spy2.3427:2Online publication date: 7-Mar-2024
Khalid ARaza MAfsar PKhan RMohmand MRahman H(2024)A SWOT Analysis of Software Development Life Cycle Security MetricsJournal of Software: Evolution and Process10.1002/smr.2744Online publication date: 27-Nov-2024
https://doi.org/10.1002/smr.2744
Nägele SKorn LMatthes F(2023)Adoption of Information Security Practices in Large-Scale Agile Software Development: A Case Study in the Finance IndustryProceedings of the 18th International Conference on Availability, Reliability and Security10.1145/3600160.3600170(1-12)Online publication date: 29-Aug-2023
https://dl.acm.org/doi/10.1145/3600160.3600170
Ryan IRoedig UStol KGrundy JPollock LPenta M(2023)Measuring Secure Coding Practice and Culture: A Finger Pointing at the Moon is Not the MoonProceedings of the 45th International Conference on Software Engineering10.1109/ICSE48619.2023.00140(1622-1634)Online publication date: 14-May-2023
https://dl.acm.org/doi/10.1109/ICSE48619.2023.00140
Ardo ABass JGaber T(2023)Implications of regulatory policy for building secure agile software in NigeriaThe Electronic Journal of Information Systems in Developing Countries10.1002/isd2.1228589:6Online publication date: 7-Nov-2023
Nägele SWatzelt JMatthes F(2022)Investigating the Current State of Security in Large-Scale Agile DevelopmentAgile Processes in Software Engineering and Extreme Programming10.1007/978-3-031-08169-9_13(203-219)Online publication date: 9-Jun-2022
https://doi.org/10.1007/978-3-031-08169-9_13
Ardo ABass JGaber T(2022)An Empirical Investigation of Agile Information Systems Development for CybersecurityInformation Systems10.1007/978-3-030-95947-0_40(567-581)Online publication date: 16-Feb-2022
https://doi.org/10.1007/978-3-030-95947-0_40
Hjerppe KRuohonen JLeppanen V(2019)The General Data Protection Regulation: Requirements, Architectures, and Constraints2019 IEEE 27th International Requirements Engineering Conference (RE)10.1109/RE.2019.00036(265-275)Online publication date: Sep-2019
https://doi.org/10.1109/RE.2019.00036

View Options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Media

Figures

Other

Tables

View Table of Contents