Towards Automated Security Design Flaw Detection
Paper i proceeding, 2019

Efficiency of security-by-design has become an important goal for organizations implementing software engineering practices such as Agile, DevOps, and Continuous Integration. Software architectures are (often manually) analyzed at design time for potential security design flaws, based on natural language descriptions of security weaknesses (e.g., CWE, CAPEC). The use of natural language hinders the application of such knowledge bases in an automated fashion. In this paper, we analyze an existing catalog of 19 security design flaws in order to identify conceptual, technology-independent requirements on architectural models that enable automatically detecting these flaws. This constitutes the first step towards automated assessment of design-level security. Our findings are illustrated on an IoT-based smart home system.

Security

design inspection

design analysis

design flaws

Författare

Laurens Sion

KU Leuven

Katja Tuma

Chalmers, Data- och informationsteknik, Software Engineering, Software Engineering for Cyber Physical Systems

Riccardo Scandariato

Chalmers, Data- och informationsteknik, Software Engineering, Software Engineering for Cyber Physical Systems

Koen Yskout

KU Leuven

Proceedings - 2019 34th IEEE/ACM International Conference on Automated Software Engineering Workshops, ASEW 2019

49-56

34th IEEE/ACM International Conference on Automated Software Engineering Workshop (ASEW)
San Diego, USA,

Datasäkerhet för fordonssystem i en föränderlig miljö - fas 1 (CyReV)

VINNOVA, 2019-04-01 -- 2021-03-31.

Ämneskategorier

Programvaruteknik

Systemvetenskap

Datorsystem

DOI

10.1109/ASEW.2019.00028

Mer information

Skapat

2020-11-16