The days before zero day: investment models for secure software engineering
While the majority of security practice — and spending — is focused on post-development products and enterprise approaches, some have sought to change the focus of security from the networks we manage to the systems we build. The burgeoning Secure Software Engineering (SSE) community has sought to i...
| Main Authors: | , , |
|---|---|
| Format: | Conference item |
| Language: | English |
| Published: |
2016
|
| _version_ | 1811141275572764672 |
|---|---|
| author | Heitzenrater, C Böhme, R Simpson, A |
| author_facet | Heitzenrater, C Böhme, R Simpson, A |
| author_sort | Heitzenrater, C |
| collection | OXFORD |
| description | While the majority of security practice — and
spending — is focused on post-development products and
enterprise approaches, some have sought to change the focus of
security from the networks we manage to the systems we build.
The burgeoning Secure Software Engineering (SSE) community has sought to identify and espouse activities, built upon
traditional software engineering, that address the introduction
of vulnerabilities as a means of stemming the growing tide
of security problems before they can be realised. It is widely
believed that not only do such approaches hold promise to limit
exposure and reduce security incidents, but they are also a valid
security investment that decreases overall security expenditure.
While many initiatives are now underway to codify such
SSE practices, a treatment of the economic considerations
has yet to be conducted. We propose an initial model that
captures SSE investment as a means of reducing defender
uncertainty regarding vulnerabilities, while raising the cost
to the attacker. This approach is instantiated as a companion
process to traditional security models, and we use the Iterated
Weakest Link (IWL) model of (post-deployment) security investment to demonstrate how defender security investment can
be optimised over the system’s lifecycle. The results indicate
both an increased return on security investment — the Return
on Secure Software Process (ROSSP) — as well as reduced
post-deployment costs. It is our hope that this model paves the
way for a more comprehensive treatment of security investment
that unifies pre- and post-security investment, leading to a more
comprehensive view of security in software systems. |
| first_indexed | 2024-03-07T01:28:33Z |
| format | Conference item |
| id | oxford-uuid:92cc2384-4fa2-487a-b297-f667d6c115cb |
| institution | University of Oxford |
| language | English |
| last_indexed | 2024-09-25T04:35:17Z |
| publishDate | 2016 |
| record_format | dspace |
| spelling | oxford-uuid:92cc2384-4fa2-487a-b297-f667d6c115cb2024-09-17T12:09:28ZThe days before zero day: investment models for secure software engineeringConference itemhttp://purl.org/coar/resource_type/c_5794uuid:92cc2384-4fa2-487a-b297-f667d6c115cbEnglishSymplectic Elements at Oxford2016Heitzenrater, CBöhme, RSimpson, AWhile the majority of security practice — and spending — is focused on post-development products and enterprise approaches, some have sought to change the focus of security from the networks we manage to the systems we build. The burgeoning Secure Software Engineering (SSE) community has sought to identify and espouse activities, built upon traditional software engineering, that address the introduction of vulnerabilities as a means of stemming the growing tide of security problems before they can be realised. It is widely believed that not only do such approaches hold promise to limit exposure and reduce security incidents, but they are also a valid security investment that decreases overall security expenditure. While many initiatives are now underway to codify such SSE practices, a treatment of the economic considerations has yet to be conducted. We propose an initial model that captures SSE investment as a means of reducing defender uncertainty regarding vulnerabilities, while raising the cost to the attacker. This approach is instantiated as a companion process to traditional security models, and we use the Iterated Weakest Link (IWL) model of (post-deployment) security investment to demonstrate how defender security investment can be optimised over the system’s lifecycle. The results indicate both an increased return on security investment — the Return on Secure Software Process (ROSSP) — as well as reduced post-deployment costs. It is our hope that this model paves the way for a more comprehensive treatment of security investment that unifies pre- and post-security investment, leading to a more comprehensive view of security in software systems. |
| spellingShingle | Heitzenrater, C Böhme, R Simpson, A The days before zero day: investment models for secure software engineering |
| title | The days before zero day: investment models for secure software engineering |
| title_full | The days before zero day: investment models for secure software engineering |
| title_fullStr | The days before zero day: investment models for secure software engineering |
| title_full_unstemmed | The days before zero day: investment models for secure software engineering |
| title_short | The days before zero day: investment models for secure software engineering |
| title_sort | days before zero day investment models for secure software engineering |
| work_keys_str_mv | AT heitzenraterc thedaysbeforezerodayinvestmentmodelsforsecuresoftwareengineering AT bohmer thedaysbeforezerodayinvestmentmodelsforsecuresoftwareengineering AT simpsona thedaysbeforezerodayinvestmentmodelsforsecuresoftwareengineering AT heitzenraterc daysbeforezerodayinvestmentmodelsforsecuresoftwareengineering AT bohmer daysbeforezerodayinvestmentmodelsforsecuresoftwareengineering AT simpsona daysbeforezerodayinvestmentmodelsforsecuresoftwareengineering |