Recent trends in the software development practices (Agile, De-vOps, CI) have shortened the development life-cycle causing the need for efficient security-by-design approaches. In this context, software architectures are analyzed for potential vulnerabilities and design flaws. Yet, design flaws are often documented with natural language and require a manual analysis, which is inefficient. Besides low-level vulnerability databases (e.g., CWE, CAPEC) there is little systematized knowledge on security design flaws. The purpose of this work is to present and evaluate a catalog of security design flaws accompanied by inspection guidelines for their detection. To this aim, we conduct empirical studies with master and doctoral students. This paper presents a catalog of 19 inspection guidelines for detecting security design flaws and contributes with an empirical evaluation of the inspection guidelines. We also account for the shortcomings of the inspection guidelines and make suggestions for their improvement with respect to the generalization of guidelines, catalog re-organization, and format of documentation. We record similar precision, recall, and productivity in both empirical studies.
|Title of host publication||13th European Conference on Software Architecture, ECSA 2019 - Companion Proceedings|
|Editors||Laurence Duchien, Anne Koziolek, Raffaela Mirandola, Elena Maria Navarro Martinez, Clement Quinton, Ricardo Scandariato, Patrizia Scandurra, Catia Trubiani, Danny Weyns|
|Publisher||Association for Computing Machinery|
|Number of pages||7|
|Publication status||Published - 9 Sep 2019|
|Event||13th European Conference on Software Architecture, ECSA 2019 - Paris, France|
Duration: 9 Sep 2019 → 13 Sep 2019
|Name||ACM International Conference Proceeding Series|
|Conference||13th European Conference on Software Architecture, ECSA 2019|
|Period||9/09/19 → 13/09/19|
Bibliographical notePublisher Copyright:
© 2019 ACM.
Copyright 2020 Elsevier B.V., All rights reserved.
- Empirical software engineering
- Security design flaws