A Maturity Model for Secure Software Design: A Multivocal Study
Security is one of the most important software quality attributes. Software security is about designing and developing secure software that does not allow the integrity, confidentiality, and availability of its code, data, or service to be compromised. Organizations tend to consider security as an a...
| Main Authors: | , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2020-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/9268931/ |
| _version_ | 1818330501526585344 |
|---|---|
| author | Hassan Al-Matouq Sajjad Mahmood Mohammad Alshayeb Mahmood Niazi |
| author_facet | Hassan Al-Matouq Sajjad Mahmood Mohammad Alshayeb Mahmood Niazi |
| author_sort | Hassan Al-Matouq |
| collection | DOAJ |
| description | Security is one of the most important software quality attributes. Software security is about designing and developing secure software that does not allow the integrity, confidentiality, and availability of its code, data, or service to be compromised. Organizations tend to consider security as an afterthought, and they continue to suffer from security risks. Developing secure software requires taking security into consideration in all phases of the Software Development Life Cycle (SDLC). Several approaches have been developed to improve software quality, such as Capability Maturity Model Integration (CMMI). However, software security issues have not been addressed in a proper manner and incorporating security practices into the SDLC remains a challenge. The objective of this paper is to develop a framework to improve the process of designing secure products in software development organizations. To achieve this objective, a Multivocal Literature Review (MLR) was conducted to identify the relevant studies in both the formal and grey literature. A total of 38 primary studies were identified, and available evidence was synthesized into 8 knowledge areas and 65 best practices to build a Secure Software Design Maturity Model (SSDMM). The framework was developed based on the structure of CMMI v2.0 and evaluated through case studies in real-world environments. The case study results indicate that SSDMM is useful in measuring the maturity level of an organization for the secure design phase of SDLC. SSDMM will assist organizations in evaluating and improving their software design security practices. It will also provide a foundation for researchers to develop new software security approaches. |
| first_indexed | 2024-12-13T13:04:58Z |
| format | Article |
| id | doaj.art-f5a0c7c22fd14b9a91494e2b3073abd4 |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-12-13T13:04:58Z |
| publishDate | 2020-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-f5a0c7c22fd14b9a91494e2b3073abd42022-12-21T23:44:51ZengIEEEIEEE Access2169-35362020-01-01821575821577610.1109/ACCESS.2020.30402209268931A Maturity Model for Secure Software Design: A Multivocal StudyHassan Al-Matouq0https://orcid.org/0000-0002-8804-5486Sajjad Mahmood1https://orcid.org/0000-0001-5786-5118Mohammad Alshayeb2https://orcid.org/0000-0001-7950-0099Mahmood Niazi3https://orcid.org/0000-0001-7318-7644Information and Computer Science Department, King Fahd University of Petroleum and Minerals, Dhahran, Saudi ArabiaInformation and Computer Science Department, King Fahd University of Petroleum and Minerals, Dhahran, Saudi ArabiaInformation and Computer Science Department, King Fahd University of Petroleum and Minerals, Dhahran, Saudi ArabiaInformation and Computer Science Department, King Fahd University of Petroleum and Minerals, Dhahran, Saudi ArabiaSecurity is one of the most important software quality attributes. Software security is about designing and developing secure software that does not allow the integrity, confidentiality, and availability of its code, data, or service to be compromised. Organizations tend to consider security as an afterthought, and they continue to suffer from security risks. Developing secure software requires taking security into consideration in all phases of the Software Development Life Cycle (SDLC). Several approaches have been developed to improve software quality, such as Capability Maturity Model Integration (CMMI). However, software security issues have not been addressed in a proper manner and incorporating security practices into the SDLC remains a challenge. The objective of this paper is to develop a framework to improve the process of designing secure products in software development organizations. To achieve this objective, a Multivocal Literature Review (MLR) was conducted to identify the relevant studies in both the formal and grey literature. A total of 38 primary studies were identified, and available evidence was synthesized into 8 knowledge areas and 65 best practices to build a Secure Software Design Maturity Model (SSDMM). The framework was developed based on the structure of CMMI v2.0 and evaluated through case studies in real-world environments. The case study results indicate that SSDMM is useful in measuring the maturity level of an organization for the secure design phase of SDLC. SSDMM will assist organizations in evaluating and improving their software design security practices. It will also provide a foundation for researchers to develop new software security approaches.https://ieeexplore.ieee.org/document/9268931/Software designsoftware qualitycapability-based security |
| spellingShingle | Hassan Al-Matouq Sajjad Mahmood Mohammad Alshayeb Mahmood Niazi A Maturity Model for Secure Software Design: A Multivocal Study IEEE Access Software design software quality capability-based security |
| title | A Maturity Model for Secure Software Design: A Multivocal Study |
| title_full | A Maturity Model for Secure Software Design: A Multivocal Study |
| title_fullStr | A Maturity Model for Secure Software Design: A Multivocal Study |
| title_full_unstemmed | A Maturity Model for Secure Software Design: A Multivocal Study |
| title_short | A Maturity Model for Secure Software Design: A Multivocal Study |
| title_sort | maturity model for secure software design a multivocal study |
| topic | Software design software quality capability-based security |
| url | https://ieeexplore.ieee.org/document/9268931/ |
| work_keys_str_mv | AT hassanalmatouq amaturitymodelforsecuresoftwaredesignamultivocalstudy AT sajjadmahmood amaturitymodelforsecuresoftwaredesignamultivocalstudy AT mohammadalshayeb amaturitymodelforsecuresoftwaredesignamultivocalstudy AT mahmoodniazi amaturitymodelforsecuresoftwaredesignamultivocalstudy AT hassanalmatouq maturitymodelforsecuresoftwaredesignamultivocalstudy AT sajjadmahmood maturitymodelforsecuresoftwaredesignamultivocalstudy AT mohammadalshayeb maturitymodelforsecuresoftwaredesignamultivocalstudy AT mahmoodniazi maturitymodelforsecuresoftwaredesignamultivocalstudy |