The Experts below are selected from a list of 105 Experts worldwide ranked by ideXlab platform
Fabio Massacci - One of the best experts on this subject based on the ideXlab platform.
-
on the Effort for Security maintenance of open source components
Workshop on the Economics of Information Security, 2018Co-Authors: Stanislav Dashevskyi, Achim D. Brucker, Fabio MassacciAbstract:The work presented in this paper is motivated by the need to estimate the Security Effort of maintaining Free and Open Source Software (FOSS) components within the software supply chain of a large international software vendor. We investigated publicly available factors (from number of active users to commits, from code size to usage of popular programming languages, etc.) to identify which ones impact three potential Effort models: centralized (the company checks each component and propagates changes to the product groups), distributed (each product group is in charge of evaluating and fixing its consumed FOSS components), and hybrid (seldom used components are checked individually by each development team, the rest is centralized). We use Grounded Theory to extract the factors from a six months study at the vendor. We report the results on a sample of 166 FOSS components used by the vendor.
-
ESSoS - On the Security Cost of Using a Free and Open Source Component in a Proprietary Product
Lecture Notes in Computer Science, 2016Co-Authors: Stanislav Dashevskyi, Achim D. Brucker, Fabio MassacciAbstract:The work presented in this paper is motivated by the need to estimate the Security Effort of consuming Free and Open Source Software FOSS components within a proprietary software supply chain of a large European software vendor. To this extent we have identified three different cost models: centralized the company checks each component and propagates changes to the different product groups, distributed each product group is in charge of evaluating and fixing its consumed FOSS components, and hybrid only the least used components are checked individually by each development team. We investigated publicly available factors e.i¾?g., development activity such as commits, code size, or fraction of code size in different programming languages to identify which one has the major impact on the Security Effort of using a FOSS component in a larger software product.
Elaine Venson - One of the best experts on this subject based on the ideXlab platform.
-
the effects of required Security on software development Effort
International Conference on Software Engineering, 2020Co-Authors: Elaine VensonAbstract:Problem: developers are increasingly adopting Security practices in software projects in response to cyber threats. Despite the additional Effort required to perform those practices, current cost models either do not consider Security as an input or were not properly validated with empirical data. Hypothesis: increasing degrees of application of Security practices and Security features, motivated by Security risks, lead to growing levels of added software development Effort. Such an Effort increase can be quantified through a parametric model that takes as input the usage degrees of Security practices and requirements and outputs the additional software development Effort. Contributions: the accurate prediction of secure software development Effort will support the provision of a proper amount of resources to projects. We also expect that the quantification of the Security Effort will contribute to advance research on the cost-effectiveness of software Security.
-
the impact of software Security practices on development Effort an initial survey
Empirical Software Engineering and Measurement, 2019Co-Authors: Elaine Venson, Reem Alfayez, M Gomes F Marilia, M Figueiredo C Rejane, Barry BoehmAbstract:Background: Software projects are facing the need to adopt Security practices during the software development life cycle (SDLC). Nevertheless, the amount of Effort to be invested in order to achieve a certain level of software Security is not clear yet. Aims: The goal of this study is to get an overview of the application of software Security practices in the industry and to identify the impact of the introduction of such activities in software development projects in terms of Effort/cost. Method: We conducted a survey on a software Security group of a professional social network by applying a random sampling strategy to establish a representative set of participants. Results: The questionnaire was fully answered by 110 participants, from the 808 profiles that were invited from the sampling frame. The results show that Security practices have been applied thoroughly in the projects and revealed high variability in secure software development Effort across the participants’ projects. Further research is needed to understand the different professionals’ perspectives regarding Security Effort in projects. As lessons learned, we found that the professional social network offered a demographically diverse sampling frame, but this comes with hurdles that need to be overcome. Conclusions: The experiences of the participants showed that Security is a factor that drives Effort in software projects, and Security practices need to be taken into account when planning software development initiatives. Our findings about the current state of practices and adoptions can help practitioners and researchers in future endeavors.
Stanislav Dashevskyi - One of the best experts on this subject based on the ideXlab platform.
-
on the Effort for Security maintenance of open source components
Workshop on the Economics of Information Security, 2018Co-Authors: Stanislav Dashevskyi, Achim D. Brucker, Fabio MassacciAbstract:The work presented in this paper is motivated by the need to estimate the Security Effort of maintaining Free and Open Source Software (FOSS) components within the software supply chain of a large international software vendor. We investigated publicly available factors (from number of active users to commits, from code size to usage of popular programming languages, etc.) to identify which ones impact three potential Effort models: centralized (the company checks each component and propagates changes to the product groups), distributed (each product group is in charge of evaluating and fixing its consumed FOSS components), and hybrid (seldom used components are checked individually by each development team, the rest is centralized). We use Grounded Theory to extract the factors from a six months study at the vendor. We report the results on a sample of 166 FOSS components used by the vendor.
-
ESSoS - On the Security Cost of Using a Free and Open Source Component in a Proprietary Product
Lecture Notes in Computer Science, 2016Co-Authors: Stanislav Dashevskyi, Achim D. Brucker, Fabio MassacciAbstract:The work presented in this paper is motivated by the need to estimate the Security Effort of consuming Free and Open Source Software FOSS components within a proprietary software supply chain of a large European software vendor. To this extent we have identified three different cost models: centralized the company checks each component and propagates changes to the different product groups, distributed each product group is in charge of evaluating and fixing its consumed FOSS components, and hybrid only the least used components are checked individually by each development team. We investigated publicly available factors e.i¾?g., development activity such as commits, code size, or fraction of code size in different programming languages to identify which one has the major impact on the Security Effort of using a FOSS component in a larger software product.
Rick Kazman - One of the best experts on this subject based on the ideXlab platform.
-
natural language processing to quantify Security Effort in the software development lifecycle
Software Engineering and Knowledge Engineering, 2015Co-Authors: Constantine Cois, Rick KazmanAbstract:Addressing Security in the software development lifecycle is an ever-present concern for software engineers and organizations. From a management and monitoring perspective, it is difficult to measure 1) the amount of Effort being focused on Security concerns during active development and 2) the success of Security related design and development Efforts. Such data is simply not recorded. If reliable measurements were available, software project leaders would have a powerful tool to assess risk and inform decision making. This would enable managers to direct development and testing to assure a desired level of Security in their software products, to protect both their organizations and customers. To fill this need and provide such data, we propose a technique for performing topic detection on data commonly available in most software development projects: text artifacts from issue tracking and version control systems. We apply machine learning and natural language processing techniques to create classifiers capable of accurately detecting whether a given text snippet is related to the topic of Security. Realization of such a capability will give software teams the ability to analyze current and past levels of Security Effort, revealing immediate project focus and the long-term impacts of Security tasking. We validate our approach via experiments on data from the large-scale open source Chromium software project. Our results show that a Naive Bayes classification scheme using an n-gram feature-space is an appropriate and effective approach to automated topic detection of software Security text snippets, and that effective training data can be derived from public data sources without the need for manual intervention.
-
SEKE - Natural Language Processing to Quantify Security Effort in the Software Development Lifecycle
2015Co-Authors: Constantine Cois, Rick KazmanAbstract:Addressing Security in the software development lifecycle is an ever-present concern for software engineers and organizations. From a management and monitoring perspective, it is difficult to measure 1) the amount of Effort being focused on Security concerns during active development and 2) the success of Security related design and development Efforts. Such data is simply not recorded. If reliable measurements were available, software project leaders would have a powerful tool to assess risk and inform decision making. This would enable managers to direct development and testing to assure a desired level of Security in their software products, to protect both their organizations and customers. To fill this need and provide such data, we propose a technique for performing topic detection on data commonly available in most software development projects: text artifacts from issue tracking and version control systems. We apply machine learning and natural language processing techniques to create classifiers capable of accurately detecting whether a given text snippet is related to the topic of Security. Realization of such a capability will give software teams the ability to analyze current and past levels of Security Effort, revealing immediate project focus and the long-term impacts of Security tasking. We validate our approach via experiments on data from the large-scale open source Chromium software project. Our results show that a Naive Bayes classification scheme using an n-gram feature-space is an appropriate and effective approach to automated topic detection of software Security text snippets, and that effective training data can be derived from public data sources without the need for manual intervention.
Achim D. Brucker - One of the best experts on this subject based on the ideXlab platform.
-
on the Effort for Security maintenance of open source components
Workshop on the Economics of Information Security, 2018Co-Authors: Stanislav Dashevskyi, Achim D. Brucker, Fabio MassacciAbstract:The work presented in this paper is motivated by the need to estimate the Security Effort of maintaining Free and Open Source Software (FOSS) components within the software supply chain of a large international software vendor. We investigated publicly available factors (from number of active users to commits, from code size to usage of popular programming languages, etc.) to identify which ones impact three potential Effort models: centralized (the company checks each component and propagates changes to the product groups), distributed (each product group is in charge of evaluating and fixing its consumed FOSS components), and hybrid (seldom used components are checked individually by each development team, the rest is centralized). We use Grounded Theory to extract the factors from a six months study at the vendor. We report the results on a sample of 166 FOSS components used by the vendor.
-
ESSoS - On the Security Cost of Using a Free and Open Source Component in a Proprietary Product
Lecture Notes in Computer Science, 2016Co-Authors: Stanislav Dashevskyi, Achim D. Brucker, Fabio MassacciAbstract:The work presented in this paper is motivated by the need to estimate the Security Effort of consuming Free and Open Source Software FOSS components within a proprietary software supply chain of a large European software vendor. To this extent we have identified three different cost models: centralized the company checks each component and propagates changes to the different product groups, distributed each product group is in charge of evaluating and fixing its consumed FOSS components, and hybrid only the least used components are checked individually by each development team. We investigated publicly available factors e.i¾?g., development activity such as commits, code size, or fraction of code size in different programming languages to identify which one has the major impact on the Security Effort of using a FOSS component in a larger software product.