Investigação das práticas proativas de desenvolvimento de software seguro adotadas por pequenos times de desenvolvimento
Resumo
Com o crescimento dos perigos da internet, a computação confiável introduziu na indústria de software uma nova filosofia de desenvolvimento, impondo a adoção de práticas seguras durante todo o ciclo de desenvolvimento. A partir do estudo dos ciclos seguros de desenvolvimento da Microsoft, Safecode e Touchpoints, esse trabalho desenvolveu um survey com o objetivo de investigar as práticas de desenvolvimento de software seguro adotadas por pequenos times de desenvolvimento. Os resultados observados foram correlacionados com as diretrizes de segurança dos três ciclos estudados e apontaram que práticas de segurança importantes como teste de penetração e análise estática e dinâmica de código não são frequentemente utilizadas por times pequenos.
Palavras-chave:
Software, Ciclo de desenvolvimento
Referências
Poneman Institute (2018), “2018 cost of a data breach study: Global overview”, https://securityintelligence.com/ponemon-cost-of-a-data-breach-2018/.
IBM Security (2020), “Relatório sobre o prejuízo de um vazamento de dados 2020”, https://www.ibm.com/security/digital-assets/cost-data-breach-report/#/pt
L. Williams (2019), “Secure Software Lifecycle in CyBOK Version 1.0”, The National Cyber Security Centre 2019.
G. McGraw (1998), “Testing for security during development: why we should scrap penetrate-and-patch”, IEEE Aerospace and Electronic Systems Magazine, vol. 13, no. 4, pp. 13–15.
M. Howard (2006) and S. Lipner, The Security Development Lifecycle. Redmond, WA, USA: Microsoft Press.
G. McGraw (2006), Software Security: Building Security In. Addison-Wesley Professional.
SAFECode (2018), “Fundamental practices for secure software development: Essential elements of a secure development lifecycle program”, 3th Edition, https://safecode.org/wp-content/uploads/2018/03/SAFECode_Fundamental_Practices_for_Secure_Software_Development_March_2018.pdf.
Stripe (2018), “Old and Bad Code Waste Billions”, https://www.i-programmer.info/news/99-professional/12118-old-and-bad-code-waste-billions.html.
OWASP (2020), “SAMM”, https://github.com/OWASP/samm/blob/master/Supporting%20Resources/v2.0/OWASP-SAMM-v2.0.pdf.
OWASP (2017), “OWASP top 10 – 2017”, https://owasp.org/www-pdf-archive/OWASP_Top_10-2017_%28en%29.pdf.pdf.
Microsoft (2017), “Microsoft Threat Modeling Tool threats”, https://docs.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-threats.
ISC2 (2020), “Cybersecurity Workforce Study”, https://www.isc2.org/Research.
Sarah Elder, Nusrat Zahan, Val Kozarev, Rui Shu, Tim Menzies, Laurie Williams (2021), “Structuring a Comprehensive Software Security Course Around the OWASP Application Security Verification Standard”, https://arxiv.org/abs/2103.05088.
IBM Security (2020), “Relatório sobre o prejuízo de um vazamento de dados 2020”, https://www.ibm.com/security/digital-assets/cost-data-breach-report/#/pt
L. Williams (2019), “Secure Software Lifecycle in CyBOK Version 1.0”, The National Cyber Security Centre 2019.
G. McGraw (1998), “Testing for security during development: why we should scrap penetrate-and-patch”, IEEE Aerospace and Electronic Systems Magazine, vol. 13, no. 4, pp. 13–15.
M. Howard (2006) and S. Lipner, The Security Development Lifecycle. Redmond, WA, USA: Microsoft Press.
G. McGraw (2006), Software Security: Building Security In. Addison-Wesley Professional.
SAFECode (2018), “Fundamental practices for secure software development: Essential elements of a secure development lifecycle program”, 3th Edition, https://safecode.org/wp-content/uploads/2018/03/SAFECode_Fundamental_Practices_for_Secure_Software_Development_March_2018.pdf.
Stripe (2018), “Old and Bad Code Waste Billions”, https://www.i-programmer.info/news/99-professional/12118-old-and-bad-code-waste-billions.html.
OWASP (2020), “SAMM”, https://github.com/OWASP/samm/blob/master/Supporting%20Resources/v2.0/OWASP-SAMM-v2.0.pdf.
OWASP (2017), “OWASP top 10 – 2017”, https://owasp.org/www-pdf-archive/OWASP_Top_10-2017_%28en%29.pdf.pdf.
Microsoft (2017), “Microsoft Threat Modeling Tool threats”, https://docs.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-threats.
ISC2 (2020), “Cybersecurity Workforce Study”, https://www.isc2.org/Research.
Sarah Elder, Nusrat Zahan, Val Kozarev, Rui Shu, Tim Menzies, Laurie Williams (2021), “Structuring a Comprehensive Software Security Course Around the OWASP Application Security Verification Standard”, https://arxiv.org/abs/2103.05088.
Publicado
18/07/2021
Como Citar
RODRIGUES, João Paulo de S.; CORDOVIL, Kleverton Robson da Silva; OHASHI JUNIOR, Orlando Shigueo; TORRES, Renato Hidaka.
Investigação das práticas proativas de desenvolvimento de software seguro adotadas por pequenos times de desenvolvimento. In: SEMINÁRIO INTEGRADO DE SOFTWARE E HARDWARE (SEMISH), 48. , 2021, Evento Online.
Anais [...].
Porto Alegre: Sociedade Brasileira de Computação,
2021
.
p. 241-250.
ISSN 2595-6205.
DOI: https://doi.org/10.5753/semish.2021.15828.
