research-article

Continuous compliance

Authors:

Martin Kellogg,

Serdar Tasiran,

Michael D. ErnstAuthors Info & Claims

ASE '20: Proceedings of the 35th IEEE/ACM International Conference on Automated Software Engineering

Pages 511 - 523

https://doi.org/10.1145/3324884.3416593

Published: 27 January 2021 Publication History

Abstract

Vendors who wish to provide software or services to large corporations and governments must often obtain numerous certificates of compliance. Each certificate asserts that the software satisfies a compliance regime, like SOC or the PCI DSS, to protect the privacy and security of sensitive data. The industry standard for obtaining a compliance certificate is an auditor manually auditing source code. This approach is expensive, error-prone, partial, and prone to regressions.

We propose continuous compliance to guarantee that the codebase stays compliant on each code change using lightweight verification tools. Continuous compliance increases assurance and reduces costs.

Continuous compliance is applicable to any source-code compliance requirement. To illustrate our approach, we built verification tools for five common audit controls related to data security: cryptographically unsafe algorithms must not be used, keys must be at least 256 bits long, credentials must not be hard-coded into program text, HTTPS must always be used instead of HTTP, and cloud data stores must not be world-readable.

We evaluated our approach in three ways. (1) We applied our tools to over 5 million lines of open-source software. (2) We compared our tools to other publicly-available tools for detecting misuses of encryption on a previously-published benchmark, finding that only ours are suitable for continuous compliance. (3) We deployed a continuous compliance process at AWS, a large cloud-services company: we integrated verification tools into the compliance process (including auditors accepting their output as evidence) and ran them on over 68 million lines of code. Our tools and the data for the former two evaluations are publicly available.

References

[1]

2002. FIPS PUB 140-2, Security Requirements for Cryptographic Modules. U.S.Department of Commerce/National Institute of Standards and Technology.

[2]

Bhargav Acharya. 2016. Why Cloud Providers Need a SOC Report. https://www.schellman.com/blog/why-cloud-providers-need-a-soc-report. Accessed 28 March 2019.

[3]

Sharmin Afrose, Sazzadur Rahaman, and Danfeng Yao. 2019. CryptoAPI-Bench: A Comprehensive Benchmark on Java Cryptographic API Misuses. In 2019 IEEE Cybersecurity Development (SecDev). IEEE, 49--61.

[4]

AICPA. 2017. SOC 2 examinations and SOC for Cybersecurity examinations: Understanding the key distinctions. https://www.aicpa.org/content/dam/aicpa/interestareas/frc/assuranceadvisoryservices/downloadabledocuments/cybersecurity/soc-2--vs-cyber-whitepaper-web-final.pdf. Accessed 1 February 2019.

[5]

Amazon Web Services, Inc. 2006. Amazon S3. https://aws.amazon.com/s3/. Accessed 17 April 2020.

[6]

aws-kms-compliance-checker Developers. 2020. awslabs/aws-kms-compliance-checker. https://github.com/awslabs/aws-kms-compliance-checker. Accessed 11 August 2020.

[7]

awslabs/aws-crypto-policy-compliance-checker Developers. 2020. awslabs/aws-crypto-policy-compliance-checker. https://github.com/awslabs/aws-crypto-policy-compliance-checker. Accessed 11 August 2020.

[8]

Nathaniel Ayewah, David Hovemeyer, J. David Morgenthaler, John Penix, and William Pugh. 2008. Using static analysis to find bugs. IEEE Software 25, 5 (September 2008), 22--29.

Digital Library

[9]

Ghada Bahig and Amr El-Kadi. 2017. Formal verification of automotive design in compliance with ISO 26262 design verification guidelines. IEEE Access 5 (2017), 4505--4516.

[10]

Elaine B. Barker, William C. Barker, William E. Burr, W. Timothy Polk, and Miles E. Smid. 2007. SP 800-57. Recommendation for Key Management, Part 1: General (Revised). Technical Report. Gaithersburg, MD, United States.

[11]

Jason Bau, Elie Bursztein, Divij Gupta, and John Mitchell. 2010. State of the art: Automated black-box web application vulnerability testing. In 2010 IEEE Symposium on Security and Privacy. IEEE, 332--345.

Digital Library

[12]

Cinzia Bernardeschi, Alessandro Fantechi, Stefania Gnesi, Salvatore Larosa, Giorgio Mongardi, and Dario Romano. 1998. A formal verification environment for railway signaling system design. Formal Methods in System Design 12, 2 (1998), 139--161.

Digital Library

[13]

Al Bessey, Ken Block, Ben Chelf, Andy Chou, Bryan Fulton, Seth Hallem, Charles Henri-Gros, Asya Kamsky, Scott McPeak, and Dawson Engler. 2010. A few billion lines of code later: using static analysis to find bugs in the real world. Commun. ACM 53, 2 (2010), 66--75.

Digital Library

[14]

Daniel Bleichenbacher. 1998. Chosen ciphertext attacks against protocols based on the RSA encryption standard PKCS# 1. In Annual International Cryptology Conference. Springer, 1--12.

[15]

Sören Bleikertz, Carsten Vogel, Thomas Groß, and Sebastian Mödersheim. 2015. Proactive security analysis of changes in virtualized infrastructures. In Proceedings of the 31st annual computer security applications conference. ACM, 51--60.

Digital Library

[16]

Grady Booch. 1991. Object Oriented Design with Applications. Benjamin/Cummings.

[17]

KA Briski, Poonam Chitale, Valerie Hamilton, Allan Pratt, B Starr, J Veroulis, and B Villard. 2008. Minimizing code defects to improve software quality and lower development costs. Development Solutions. IBM. Crawford, B., Soto, R., de la Barra, CL (2008).

[18]

bucket-complaince-checker Developers. 2020. kelloggm/bucket-compliance-checker. https://github.com/kelloggm/bucket-compliance-checker. Accessed 11 August 2020.

[19]

Matthew Campagna. 2015. Aws key management service cryptographic details.

[20]

Alexia Chatzikonstantinou, Christoforos Ntantogian, Georgios Karopoulos, and Christos Xenakis. 2016. Evaluation of cryptography usage in android applications. In International Conference on Bio-inspired Information and Communications Technologies (formerly BIONETICS). 83--90.

Digital Library

[21]

PCI Security Standards Council. 2020. Qualified Security Assessors. https://www.pcisecuritystandards.org/assessors_and_solutions/qualified_security_assessors. Accessed 14 April 2020.

[22]

CryptoGuard Developers. 2020. CryptoGuardOSS/crypto-guard. https://github.com/CryptoGuardOSS/cryptoguard/commit/2898b5b5ec25d94bbedda271638385c0fa6e0c9c. Accessed 26 April 2020.

[23]

Checker Framework Developers. 2019. Constant Value Checker. https://checkerframework.org/manual/#constant-value-checker. Accessed 10 August 2019.

[24]

Checker Framework Developers. 2020. Whole-program Inference. https://checkerframework.org/manual/#whole-program-inference. Accessed 17 April 2020.

[25]

SpotBugs Developers. 2020. SpotBugs. https://spotbugs.github.io/. Accessed 24 April 2020.

[26]

Mark Jason Dominus. 2001. Perl regular expression matching is NP-hard. https://perl.plover.com/NPC/.

[27]

Schahram Dustdar. 2010. COMPAS: Compliance-driven Models, Languages, and Architectures for Services: Publishable Summary. https://cordis.europa.eu/docs/projects/cnect/5/215175/080/reports/001-publishablesummarylongversion1.pdf. Accessed 4 April 2019.

[28]

Stacy English and Susannah Hammond. 2018. Cost of Compliance 2018. https://legal.thomsonreuters.com/content/dam/ewp-m/documents/legal/en/pdf/reports/cost-of-compliance-special-report-2018.pdf. Accessed 26 February 2019.

[29]

Michael D. Ernst, René Just, Suzanne Millstein, Werner Dietl, Stuart Pernsteiner, Franziska Roesner, Karl Koscher, Paulo Barros, Ravi Bhoraskar, Seungyeop Han, Paul Vines, and Edward X. Wu. 2014. Collaborative verification of information flow for a high-assurance app store. In CCS 2014: Proceedings of the 21st ACM Conference on Computer and Communications Security. Scottsdale, AZ, USA, 1092--1104.

[30]

Jeffrey S. Foster, Manuel Fähndrich, and Alexander Aiken. 1999. A theory of type qualifiers. In PLDI '99: Proceedings of the ACM SIGPLAN '99 Conference on Programming Language Design and Implementation. Atlanta, GA, USA, 192--203.

Digital Library

[31]

Electronic Frontier Foundation. 1998. Cracking DES: Secrets of encryption research, wiretap politics and chip design.

[32]

Martin Fowler and Matthew Foemmel. 2006. Continuous integration.

[33]

Alain Frisch and Luca Cardelli. 2004. Greedy regular expression matching. In Automata, Languages and Programming: 31st International Colloquium, ICALP 2004. Turku, Finland, 618--629.

[34]

Dan Fritsche and Bhavana Sasne. 2015. Whitepaper: The Costs of Failing a PCI-DSS Audit. https://www.hytrust.com/wp-content/uploads/2015/08/HyTrust_Cost_of_Failed_Audit.pdf. Accessed 18 March 2019.

[35]

GSA. 2017. FedRAMP SECURITY ASSESSMENT FRAMEWORK, Version 2.4. https://www.fedramp.gov/assets/resources/documents/FedRAMP_Security_Assessment_Framework.pdf. Accessed 31 January 2019.

[36]

Hossein Homaei and Hamid Reza Shahriari. 2019. Athena: A framework to automatically generate security test oracle via extracting policies from source code and intended software behaviour. Information and Software Technology 107 (2019), 112--124.

[37]

Haruo Hosoya, Jérôme Vouillon, and Benjamin C. Pierce. 2005. Regular Expression Types for XML. ACM Transactions on Programming Languages and Systems 27, 1 (January 2005), 46--90.

Digital Library

[38]

hsm-simulator Developers. 2019. gjyoung1974/hsm-simulator. https://github.com/gjyoung1974/hsm-simulator/blob/432b2b6e9fd63936347293743e54a8e572367fda/src/com/goyoung/crypto/hsmsim/commands/crypto/GenerateVISAWorkingKey.java. Accessed 5 May 2020.

[39]

Wei Huang, Yao Dong, and Ana Milanova. 2014. Type-based taint analysis for Java web applications. In International Conference on Fundamental Approaches to Software Engineering. Springer, 140--154.

Digital Library

[40]

Brittany Johnson, Yoonki Song, Emerson Murphy-Hill, and Robert Bowdidge. 2013. Why don't software developers use static analysis tools to find bugs?. In ICSE 2013, Proceedings of the 35th International Conference on Software Engineering. San Francisco, CA, USA, 672--681.

[41]

Elena Karahanna, Detmar W Straub, and Norman L Chervany. 1999. Information technology adoption across time: a cross-sectional comparison of pre-adoption and post-adoption beliefs. MIS quarterly (1999), 183--213.

[42]

Audrey Katcher. 2019. Understanding How Users Would Make Use of a SOC2 Report. https://www.rubinbrown.com/soc2_user_document_111710.pdf. Accessed 28 March 2019.

[43]

Martin Kellogg. 2020. do-like-javac. https://github.com/kelloggm/do-like-javac. Accessed 24 April 2020.

[44]

Martin Kellogg, Vlastimil Dort, Suzanne Millstein, and Michael D. Ernst. 2018. Lightweight verification of array indexing. In ISSTA 2018, Proceedings of the 2018 International Symposium on Software Testing and Analysis. Amsterdam, Netherlands, 3--14.

[45]

Martin Kellogg, Manli Ran, Manu Sridharan, Martin Schäf, and Michael D. Ernst. 2020. Verifying Object Construction. In ICSE 2020, Proceedings of the 42nd International Conference on Software Engineering. Seoul, Korea.

[46]

Natallia Kokash and Farhad Arbab. 2008. Formal behavioral modeling and compliance analysis for service-oriented systems. In International Symposium on Formal Methods for Components and Objects. Springer, 21--41.

[47]

Stefan Krüger, Johannes Späth, Karim Ali, Eric Bodden, and Mira Mezini. 2018. CrySL: An extensible approach to validating the correct usage of cryptographic APIs. In ECOOP 2018 --- Object-Oriented Programming, 32nd European Conference. Amsterdam, Netherlands, 10:1--10:27.

[48]

David Lazar, Haogang Chen, Xi Wang, and Nickolai Zeldovich. 2014. Why does cryptographic software fail?: a case study and open problems. In Asia-Pacific Workshop on Systems. ACM, 7.

Digital Library

[49]

Gary T Leavens, Albert L Baker, and Clyde Ruby. 2006. Preliminary design of JML: A behavioral interface specification language for Java. ACM SIGSOFT Software Engineering Notes 31, 3 (2006), 1--38.

Digital Library

[50]

Sebastian Lins, Stephan Schneider, and Ali Sunyaev. 2018. Trust is good, control is better: Creating secure clouds by continuous auditing. IEEE Transactions on Cloud Computing 6, 3 (2018), 890--903.

[51]

Suryadipta Majumdar, Yosr Jarraya, Momen Oqaily, Amir Alimohammadifar, Makan Pourzandi, Lingyu Wang, and Mourad Debbabi. 2017. Leaps: Learning-based proactive security auditing for clouds. In European Symposium on Research in Computer Security. Springer, 265--285.

[52]

Suryadipta Majumdar, Taous Madi, Yosr Jarraya, Makan Pourzandi, Lingyu Wang, and Mourad Debbabi. 2018. Cloud Security Auditing: Major Approaches and Existing Challenges. In Symposium on Foundations & Practice of Security.

[53]

Mastercard. 2017. Site Data Protection (SDP) Program, Frequently Asked Questions. https://globalrisk.mastercard.com/wp-content/uploads/2017/03/Site-Data-Protection-SDP-Program-FAQs-1-March-2017.pdf. Accessed 18 March 2019.

[54]

Suzanne Millstein. 2016. Implement Java 8 type argument inference. https://github.com/typetools/checker-framework/issues/979. Accessed 17 April 2020.

[55]

Deepti Mishra and Alok Mishra. 2009. Simplified software inspection process in compliance with international standards. Computer Standards & Interfaces 31, 4 (2009), 763--771.

Digital Library

[56]

MS 325E.64. 2007. Access Devices; Breach of Security. Minnesota Statutes (2018): Chapter 325E, Section 64.

[57]

Jacob Nemetz and Brett Lieblich. 2019. Dash Compliance Automation --- S3 Security Controls. https://www.dashsdk.com/docs/aws/hipaa/amazon-s3/. Accessed 8 April 2020.

[58]

no-literal-checker Developers. 2020. kelloggm/no-literal-checker. https://github.com/kelloggm/no-literal-checker. Accessed 11 August 2020.

[59]

Matthew M. Papi, Mahmood Ali, Telmo Luis Correa Jr., Jeff H. Perkins, and Michael D. Ernst. 2008. Practical pluggable types for Java. In ISSTA 2008, Proceedings of the 2008 International Symposium on Software Testing and Analysis. Seattle, WA, USA, 201--212.

[60]

Mariela Pavlova, Gilles Barthe, Lilian Burdy, Marieke Huisman, and Jean-Louis Lanet. 2004. Enforcing high-level security properties for applets. In Conference on Smart Card Research and Advanced Applications. Springer, 1--16.

[61]

PCI Security Standards Council. 2018. Payment Card Industry (PCI) Data Security Standard, v. 3.2.1. https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf. Accessed 26 February 2019.

[62]

PCI Security Standards Council. 2018. PCI DSS v3.2.1 Template for Report on Compliance. https://www.pcisecuritystandards.org/documents/PCI-DSS-v3_2_1-ROC-Reporting-Template.pdf. Accessed 4 April 2019.

[63]

Ponemon Institute LLC. 2011. The True Cost of Compliance. https://www.ponemon.org/local/upload/file/True_Cost_of_Compliance_Report_copy.pdf. Accessed 3 April 2019.

[64]

Sazzadur Rahaman, Gang Wang, and Danfeng Yao. 2019. Security Certification in Payment Card Industry: Testbeds, Measurements, and Recommendations. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security. 481--498.

Digital Library

[65]

Sazzadur Rahaman, Ya Xiao, Sharmin Afrose, Fahad Shaon, Ke Tian, Miles Frantz, Murat Kantarcioglu, and Danfeng (Daphne) Yao. 2019. CryptoGuard: High precision detection of cryptographic vulnerabilities in massive-sized Java projects. In CCS 2019: Proceedings of the 21st ACM Conference on Computer and Communications Security. London, UK, 2455--2472.

Digital Library

[66]

RCW 19.255.020. 2010. Liability of processors, businesses, and vendors. Revised Code of Washington, Title 19, Chapter 19.255, Section 19.255.020.

[67]

David Saff and Michael D. Ernst. 2003. Reducing wasted development time via continuous testing. In ISSRE 2003: Fourteenth International Symposium on Software Reliability Engineering. Denver, CO, 281--292.

[68]

Martin Schaef. 2019. Example of how to whitelist crypto algorithms. https://github.com/awslabs/aws-crypto-policy-compliance-checker/blob/master/stubs/javax.crypto.astub. Accessed 11 August 2020.

[69]

Helmut Seidl. 1990. Deciding Equivalence of Finite Tree Automata. SIAM J. Comput. 19, 3 (June 1990), 424--437.

Digital Library

[70]

sendmail Developers. 2015. NewSaigonSoft/sendmail. https://github.com/NewSaigonSoft/sendmail/blob/e31d9a86c7f863c59fc51d5fd2c1b60cc4586faf/src/main/java/com/newsaigonsoft/sendmail/SecurePassword.java. Accessed 5 May 2020.

[71]

Square, Inc. 2017. PCI Compliance: What You Need to Know. https://squareup.com/guides/pci-compliance. Accessed 18 March 2019.

[72]

Philipp Stephanow and Christian Banse. 2017. Evaluating the performance of continuous test-based cloud service certification. In International Symposium on Cluster, Cloud and Grid Computing. IEEE Press, 1117--1126.

Digital Library

[73]

Robert E. Strom and Shaula Yemini. 1986. Typestate: A programming language concept for enhancing software reliability. IEEE Transactions on Software Engineering SE-12, 1 (January 1986), 157--171.

Digital Library

[74]

The SWAMP Team. 2020. Welcome To The SWAMP. https://continuousassurance.org/. Accessed 24 April 2020.

[75]

Huy Tran, Ta'id Holmes, Ernst Oberortner, Emmanuel Mulo, Agnieszka Betkowska Cavalcante, Jacek Serafinski, Marek Tluczek, Aliaksandr Birukou, Florian Daniel, Patricia Silveira, et al. 2010. An end-to-end framework for business compliance in process-driven SOAs. In 2010 12th International Symposium on Symbolic and Numeric Algorithms for Scientific Computing. IEEE, 407--414.

Digital Library

[76]

Kazi Wali Ullah, Abu Shohel Ahmed, and Jukka Ylitalo. 2013. Towards building an automated security compliance tool for the cloud. In Trust, Security and Privacy in Computing and Communications (TrustCom). IEEE, 1587--1593.

[77]

Ciske van Oosten, Anne Turner, Cynthia B. Hanson, Dyana Pearson, Ronald Tosto, and Andi Baritchi. 2018. Verizon 2018 Payment Security Report. Accessed 26 February 2019.

[78]

Steven VanRoekel. 2011. Security Authorization of Information Systems in Cloud Computing Environments. https://www.fedramp.gov/assets/resources/documents/FedRAMP_Policy_Memo.pdf. Accessed 31 January 2019.

[79]

vault Developers. 2020. NitorCreations/vault. https://github.com/NitorCreations/vault/blob/3c3ec65879c82bb353b4cf4d22898abb0b7b578f/java/src/main/java/com/nitorcreations/vault/VaultClient.java. Accessed 8 May 2020.

[80]

VISA, Inc. 2017. Data Security Compliance Requirements for Service Providers. https://usa.visa.com/dam/VCOM/download/merchants/data-security-compliance-service-providers.pdf. Accessed 31 January 2019.

[81]

Mark N Wegman and F Kenneth Zadeck. 1991. Constant propagation with conditional branches. ACM Transactions on Programming Languages and Systems (TOPLAS) 13, 2 (1991), 181--210.

Digital Library

[82]

Jim Witschey, Olga Zielinska, Allaire Welk, Emerson Murphy-Hill, Chris Mayhorn, and Thomas Zimmermann. 2015. Quantifying developers' adoption of security tools. In Proceedings of the 2015 10th Joint Meeting on Foundations of Software Engineering. ACM, 260--271.

Digital Library

[83]

Chad Woolf, Byron Cook, and Tom McAndrew. 2019. Automate Compliance Verification on AWS Using Provable Security. https://www.youtube.com/watch?v=BbXK_-b3DTk. Accessed 25 August 2020.

Cited By

Gama DBrito AMartin AFetzer C(2024)Supporting continuous vulnerability compliance through automated identity provisioningProceedings of the 13th Latin-American Symposium on Dependable and Secure Computing10.1145/3697090.3697098(101-110)Online publication date: 26-Nov-2024
https://dl.acm.org/doi/10.1145/3697090.3697098
Angermeir FFischbach JMoyón FMendez D(2024)Towards Automated Continuous Security ComplianceProceedings of the 18th ACM/IEEE International Symposium on Empirical Software Engineering and Measurement10.1145/3674805.3690748(440-446)Online publication date: 24-Oct-2024
https://doi.org/10.1145/3674805.3690748
Elahidoost PMendez DUnterkalmsteiner MFischbach JFeiler CStreit J(2024)Practices, Challenges, and Opportunities When Inferring Requirements From Regulations in the FinTech Sector - An Industrial Study2024 IEEE 32nd International Requirements Engineering Conference Workshops (REW)10.1109/REW61692.2024.00024(137-145)Online publication date: 24-Jun-2024
https://doi.org/10.1109/REW61692.2024.00024
Show More Cited By

Index Terms

Continuous compliance
1. Software and its engineering

Recommendations

Ensuring continuous compliance through reconciling policy with usage
SACMAT '13: Proceedings of the 18th ACM symposium on Access control models and technologies

Organizations rarely define formal security properties or policies for their access control systems, often choosing to react to changing needs. This paper addresses the problem of reconciling entitlement usage with configured policies for multiple ...
Incorrect compliance and correct noncompliance with information security policies: A framework of rule-related information security behaviour
Highlights
- Information security policy compliance is not always the correct action but depends on the policy and the action.
- Information security policy compliance should be understood as rule-related behaviour.
- Judgements on employee policy (...
Abstract
Information security policy (ISP) compliance is recognized as a key measure for dealing with human errors when protecting information. A considerable and growing body of literature has studied the persuasive, deterrent, and coercive antecedents ...
Compliance to personal data protection principles

We examined how organizations' privacy policy meet the compliance requirement.We found privately-owned organizations have higher compliance level.Sectors with more personal sensitive data have significantly higher compliance score.Government sectors ...

Comments

Please enable JavaScript to view thecomments powered by Disqus.

Information & Contributors

Information

Published In

cover image ACM Conferences

ASE '20: Proceedings of the 35th IEEE/ACM International Conference on Automated Software Engineering

December 2020

1449 pages

ISBN:9781450367684

DOI:10.1145/3324884

General Chair:
John Grundy,
Program Chairs:
Claire Le Goues,
David Lo

Copyright © 2020 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected].

Sponsors

In-Cooperation

IEEE CS

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 27 January 2021

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article

Conference

ASE '20

Sponsor:

ASE '20: 35th IEEE/ACM International Conference on Automated Software Engineering

December 21 - 25, 2020

Virtual Event, Australia

Acceptance Rates

Overall Acceptance Rate 82 of 337 submissions, 24%

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

8
Total Citations
View Citations
280
Total Downloads

Downloads (Last 12 months)89
Downloads (Last 6 weeks)8

Reflects downloads up to 13 Feb 2025

Other Metrics

View Author Metrics

Citations

Cited By

Gama DBrito AMartin AFetzer C(2024)Supporting continuous vulnerability compliance through automated identity provisioningProceedings of the 13th Latin-American Symposium on Dependable and Secure Computing10.1145/3697090.3697098(101-110)Online publication date: 26-Nov-2024
https://dl.acm.org/doi/10.1145/3697090.3697098
Angermeir FFischbach JMoyón FMendez D(2024)Towards Automated Continuous Security ComplianceProceedings of the 18th ACM/IEEE International Symposium on Empirical Software Engineering and Measurement10.1145/3674805.3690748(440-446)Online publication date: 24-Oct-2024
https://doi.org/10.1145/3674805.3690748
Elahidoost PMendez DUnterkalmsteiner MFischbach JFeiler CStreit J(2024)Practices, Challenges, and Opportunities When Inferring Requirements From Regulations in the FinTech Sector - An Industrial Study2024 IEEE 32nd International Requirements Engineering Conference Workshops (REW)10.1109/REW61692.2024.00024(137-145)Online publication date: 24-Jun-2024
https://doi.org/10.1109/REW61692.2024.00024
Elahidoost P(2024)Towards a Tool Supported Approach for Regulatory Requirements Engineering2024 IEEE 32nd International Requirements Engineering Conference (RE)10.1109/RE59067.2024.00067(520-524)Online publication date: 24-Jun-2024
https://doi.org/10.1109/RE59067.2024.00067
Santilli TPelliccione PWohlrab RShahrokni A(2024)Continuous Compliance in the Automotive IndustryIEEE Software10.1109/MS.2023.334297441:4(134-142)Online publication date: 1-Jul-2024
https://dl.acm.org/doi/10.1109/MS.2023.3342974
Mountifield C(2023)Sport Analytics: Graduating From AlchemyTechnology in Sports - Recent Advances, New Perspectives and Application10.5772/intechopen.1002423Online publication date: 16-Oct-2023
https://doi.org/10.5772/intechopen.1002423
Kellogg MDaskiewicz DNgo LNguyen DAhmed MErnst MBissyandé TKlein JBird CSarro F(2023)Pluggable Type Inference for FreeProceedings of the 38th IEEE/ACM International Conference on Automated Software Engineering10.1109/ASE56229.2023.00186(1542-1554)Online publication date: 11-Nov-2023
https://dl.acm.org/doi/10.1109/ASE56229.2023.00186
Poth AKottke MHeimann CRiel A(2021)The EFIS Framework for Leveraging Agile Organizations Within Large EnterprisesAgile Processes in Software Engineering and Extreme Programming – Workshops10.1007/978-3-030-88583-0_5(42-51)Online publication date: 22-Oct-2021
https://doi.org/10.1007/978-3-030-88583-0_5

View Options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Figures

Tables

Media

View Table of Conten