Quality Assurance como primeira linha de defesa: uma análise da relação entre falhas de software e vulnerabilidades de segurança
Resumo
O aumento das ameaças cibernéticas exige abordagens preventivas baseadas no paradigma shift-left security, posicionando a Garantia da Qualidade (Quality Assurance - QA) como defesa proativa no nível do código. Neste contexto, apresenta-se uma revisão de literatura que analisou 16 estudos primários publicados a partir de 2021. Os resultados demonstram que testes automatizados interceptam defeitos lógicos em sua raiz, quebrando a cadeia causal das vulnerabilidades e reduzindo custos de correção. Conclui-se que o pleno aproveitamento desse potencial preventivo mitiga a janela de exposição a riscos, mas ainda depende da superação de barreiras de integração técnica e cultural entre as equipes de desenvolvimento, QA e segurança.
Referências
Abdi, A., Souzani, A., Amirfakhri, M., and Moghadam, A. B. (2012). Using security metrics in software quality assurance process. In 6th International Symposium on Telecommunications (IST’2012). IEEE.
Andrade, R., Torres, J., Ortiz-Garcés, I., Miño, J., and Almeida, L. (2023). An exploratory study gathering security requirements for the software development process. Electronics, 12(17):3594.
Bojanova, I. and Galhardo, C. E. C. (2023). Bug, fault, error, or weakness: Demystifying software security vulnerabilities. IT Professional. Preprint.
Corradini, D., Pasqua, M., and Ceccato, M. (2023). Automated black-box testing of mass assignment vulnerabilities in restful apis. In 45th IEEE/ACM International Conference on Software Engineering (ICSE 2023). IEEE/ACM.
Cunha, C. and Pombo, N. (2023). Automated reusable tests for mitigating secure pattern interpretation errors. IEEE Access.
Da Conceição, I. T. (2024). Práticas de segurança no desenvolvimento com o uso de metodologias ágeis. Revista Ibero-Americana de Humanidades, Ciências e Educação, 10(3):734–754.
Elias, D. (2023). Static analysis in embedded and electronic systems: Challenges, applications, and future perspectives. International Journal of Modern Computing.
Farias, R. S., Ahmed, I., and Almeida, E. S. (2025). What makes a great software quality assurance engineer? IEEE Transactions on Software Engineering, 51(4):1153–.
Kaniewski, S., Schmidt, F., Enzweiler, M., Menth, M., and Heer, T. (2025). A systematic literature review on detecting software vulnerabilities with large language models. ACM Transactions on Software Engineering and Methodology.
Kathiresan, G. (2022). Evaluating the impact of devsecops on software quality: A systematic review and empirical study. World Journal of Advanced Research and Reviews, 14(1):644–653.
Kathiresan, G. (2024). A multimodal approach to software quality assurance: Integrating static analysis, dynamic testing, and ai-based anomaly detection. International Journal of Innovative Research in Computer and Communication Engineering, 12(2).
Kathiresan, G. (2025). Resilience by design: Embedding cyber-attack scenarios into qa workflows for zero-day readiness. International Journal of Communication Networks and Information Security, 17(2).
Kitchenham, B. and Charters, S. (2007). Guidelines for performing systematic literature reviews in software engineering. Technical Report EBSE 2007-001, Keele University and Durham University Joint Report, Keele, UK.
Marques, L. F. d. F. and Silva, R. d. O. F. d. (2024). Quality assurance: a eficiência dos testes para elevar a qualidade e o desempenho do sistema. Trabalho de Conclusão de Curso, Curso Superior de Tecnologia em Tecnologia da Informação, Faculdade de Tecnologia de Assis. Orientador: Prof. Dr. José Luiz Guimarães.
Nakov, O., Trifonov, R., Nakov, P., and Pavlova, G. (2021). Analysis of software vulnerabilities, measures for prevention and protection and security testing. In 29th National Conference with International Participation “Telecom 2021”. IEEE.
NIST (2022). National Institute of Standards and Technology. Secure Software Development Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software Vulnerabilities. Special Publication NIST SP 800-218, National Institute of Standards and Technology.
Nourry, O., Kondo, M., Alfadel, M., McIntosh, S., and Kamei, Y. (2024). Exploring the adoption of fuzz testing in open-source software: A case study of the go community. In 2024 IEEE International Conference on Software Maintenance and Evolution (ICSME), pages 300–311. IEEE.
Ojuri, M. A. (2021). Evaluating cybersecurity patch management through qa performance indicators. International Journal of Technology Management & Humanities, 7(4):30–.
Ojuri, M. A. (2023). Ai-driven quality assurance for secure software development lifecycles. International Journal of Technology Management & Humanities, 9(1):25–.
Ojuri, M. A. (2024). Integrating cybersecurity standards into software quality assurance frameworks: A holistic approach. Journal of Economics, Finance and Accounting Studies, pages 258–.
Ramdass, K. (2024). Enhancing dynamic application security testing (dast): A systematic literature review. Preprint, Research Square.
Andrade, R., Torres, J., Ortiz-Garcés, I., Miño, J., and Almeida, L. (2023). An exploratory study gathering security requirements for the software development process. Electronics, 12(17):3594.
Bojanova, I. and Galhardo, C. E. C. (2023). Bug, fault, error, or weakness: Demystifying software security vulnerabilities. IT Professional. Preprint.
Corradini, D., Pasqua, M., and Ceccato, M. (2023). Automated black-box testing of mass assignment vulnerabilities in restful apis. In 45th IEEE/ACM International Conference on Software Engineering (ICSE 2023). IEEE/ACM.
Cunha, C. and Pombo, N. (2023). Automated reusable tests for mitigating secure pattern interpretation errors. IEEE Access.
Da Conceição, I. T. (2024). Práticas de segurança no desenvolvimento com o uso de metodologias ágeis. Revista Ibero-Americana de Humanidades, Ciências e Educação, 10(3):734–754.
Elias, D. (2023). Static analysis in embedded and electronic systems: Challenges, applications, and future perspectives. International Journal of Modern Computing.
Farias, R. S., Ahmed, I., and Almeida, E. S. (2025). What makes a great software quality assurance engineer? IEEE Transactions on Software Engineering, 51(4):1153–.
Kaniewski, S., Schmidt, F., Enzweiler, M., Menth, M., and Heer, T. (2025). A systematic literature review on detecting software vulnerabilities with large language models. ACM Transactions on Software Engineering and Methodology.
Kathiresan, G. (2022). Evaluating the impact of devsecops on software quality: A systematic review and empirical study. World Journal of Advanced Research and Reviews, 14(1):644–653.
Kathiresan, G. (2024). A multimodal approach to software quality assurance: Integrating static analysis, dynamic testing, and ai-based anomaly detection. International Journal of Innovative Research in Computer and Communication Engineering, 12(2).
Kathiresan, G. (2025). Resilience by design: Embedding cyber-attack scenarios into qa workflows for zero-day readiness. International Journal of Communication Networks and Information Security, 17(2).
Kitchenham, B. and Charters, S. (2007). Guidelines for performing systematic literature reviews in software engineering. Technical Report EBSE 2007-001, Keele University and Durham University Joint Report, Keele, UK.
Marques, L. F. d. F. and Silva, R. d. O. F. d. (2024). Quality assurance: a eficiência dos testes para elevar a qualidade e o desempenho do sistema. Trabalho de Conclusão de Curso, Curso Superior de Tecnologia em Tecnologia da Informação, Faculdade de Tecnologia de Assis. Orientador: Prof. Dr. José Luiz Guimarães.
Nakov, O., Trifonov, R., Nakov, P., and Pavlova, G. (2021). Analysis of software vulnerabilities, measures for prevention and protection and security testing. In 29th National Conference with International Participation “Telecom 2021”. IEEE.
NIST (2022). National Institute of Standards and Technology. Secure Software Development Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software Vulnerabilities. Special Publication NIST SP 800-218, National Institute of Standards and Technology.
Nourry, O., Kondo, M., Alfadel, M., McIntosh, S., and Kamei, Y. (2024). Exploring the adoption of fuzz testing in open-source software: A case study of the go community. In 2024 IEEE International Conference on Software Maintenance and Evolution (ICSME), pages 300–311. IEEE.
Ojuri, M. A. (2021). Evaluating cybersecurity patch management through qa performance indicators. International Journal of Technology Management & Humanities, 7(4):30–.
Ojuri, M. A. (2023). Ai-driven quality assurance for secure software development lifecycles. International Journal of Technology Management & Humanities, 9(1):25–.
Ojuri, M. A. (2024). Integrating cybersecurity standards into software quality assurance frameworks: A holistic approach. Journal of Economics, Finance and Accounting Studies, pages 258–.
Ramdass, K. (2024). Enhancing dynamic application security testing (dast): A systematic literature review. Preprint, Research Square.
Publicado
23/09/2026
Como Citar
QUEIROZ, Luan Henrique Leite Vilela de; SILVA, André Almeida.
Quality Assurance como primeira linha de defesa: uma análise da relação entre falhas de software e vulnerabilidades de segurança. In: ESCOLA REGIONAL DE COMPUTAÇÃO BAHIA, ALAGOAS E SERGIPE (ERBASE), 26. , 2026, Maragogi/AL.
Anais [...].
Porto Alegre: Sociedade Brasileira de Computação,
2026
.
p. 1-10.
DOI: https://doi.org/10.5753/erbase.2026.32167.
