Review of Techniques for Integrating Security in Software Development Lifecycle

1. Identification and classification of risk factors in distributed agile software development

2. Estimation of software development effort: A differential evolution approach10.1016/j.procs.2020.03.343 ↗

3. H. Assal and S. Chiasson, “Security in the software development lifecycle,” presented at the Fourteenth Symp. Usable Privacy Secur. (SOUPS 2018), Baltimore, MD, USA, Aug. 12–14, 2018.

4. Security assurance model of software development for global software development vendors10.1109/ACCESS.2022.3178301 ↗

5. DevSecOps: A multivocal literature review

6. Agile software development: Methodologies and trends10.3991/ijim.v14i11.13269 ↗

7. I. El Rhaffari and O. Roudiès, “Benchmarking SDL and CLASP lifecycle,” presented at the 9th Int. Conf. Intell. Syst.: Theor. Appl. (SITA-14), Rabat, Morocco, May 14–15, 2014.10.1109/SITA.2014.6847280 ↗

8. Enhancing software security through automation in the software development lifecycle

9. L. M. Clagett II, “Security requirements for the prevention of modern software vulnerabilities and a process for incorporation into classic software development lifecycles,” Ph.D. dissertation, Virginia Tech, Blacksburg, VA, USA, 2009.

10. Theory and practice in secure software development lifecycle: A comprehensive survey10.30574/wjarr.2023.18.3.0944 ↗

11. DevSecOps: A multivocal literature review

12. Embracing IaC through the DevSecOps philosophy: Concepts, challenges, and a reference framework10.1109/MS.2022.3212194 ↗

13. White · Research Anthology on Business Aspects of Cybersecurity · 2022 · 3910.4018/978-1-6684-3698-1.ch003 ↗

14. K. Qian, R. M. Parizi, and D. Lo, “OWASP risk analysis driven security requirements specification for secure Android mobile software development,” presented at the IEEE Conf. Dependable Secure Comput. (DSC), Kaohsiung, Taiwan, Dec. 2018.10.1109/DESEC.2018.8625114 ↗

15. OWASP Foundation, “OWASP Top 10,” 2021. Accessed: Dec. 04, 2024. [Online]. Available: https://owasp.org/www-project-top-ten/

16. M. Srivastava, A. Raghuvanshi, and D. Khandelwal, “Security and scalability of e-commerce website by OWASP threats,” presented at the 6th Int. Conf. Inf. Syst. Comput. Netw. (ISCON), Mathura, India, Nov. 2023.10.1109/ISCON57294.2023.10111955 ↗

17. Security risks in the software development lifecycle: A review10.30574/wjaets.2023.8.2.0101 ↗

18. Secure software development lifecycle: A case for adoption in software SMEs10.26483/ijarcs.v14i2.6955 ↗

19. D. Ferdiansyah, R. Isnanto, and J. E. Suseno, “Organizational indicators on startup software for implementing secure software development lifecycle (SSDL): A systematic literature review,” AIP Conf. Proc., vol. 2683, 2023, Art. no. 040001. doi: 10.1063/5.0125388.10.1063/5.0125388 ↗

20. X. Meng, K. Qian, D. Lo, P. Bhattacharya, and F. Wu, “Secure mobile software development with vulnerability detectors in static code analysis,” presented at the Int. Symp. Netw., Comput. Commun. (ISNCC), Rome, Italy, Jun. 2018.10.1109/ISNCC.2018.8531071 ↗

21. G. Jahanavi, T. Mubeen, R. Aishwarya, and R. Yogitha, “Cloud computing using OWASP: Open web application security project,” presented at the 7th Int. Conf. Intell. Comput. Control Syst. (ICICCS), Madurai, India, May 17–19, 2023.10.1109/ICICCS56967.2023.10142457 ↗

22. J. Gregoire, K. Buyens, B. De Win, R. Scandariato, and W. Joosen, “On the secure software development process: CLASP and SDL compared,” presented at the Third Int. Workshop Softw. Eng. Secure Syst. (SESS’07: ICSE Workshops 2007), Minneapolis, MN, USA, May 20–26, 2007.10.1109/SESS.2007.7 ↗

23. Howard · The Security Development Lifecycle: SDL: A Process for Developing Demonstrably More Secure Software · 2006

24. A. Mohammad, J. Alqatawna, and M. Abushariah, “Secure software engineering: Evaluation of emerging trends,” presented at the 8th Int. Conf. Inf. Technol. (ICIT), Amman, Jordan, May 17–18, 2017.10.1109/ICITECH.2017.8079952 ↗

25. Secure software development: Best practices

26. M. Kainerstorfer, J. Sametinger, and A. Wiesauer, “Software security for small development teams: A case study,” presented at the 13th Int. Conf. Inf. Integr. Web-Based Appl. Serv., Ho Chi Minh City, Vietnam, Dec. 5–7, 2011.10.1145/2095536.2095590 ↗

27. Changing security with every spiral

28. Roy · Computer and Cyber Security: Principles, Algorithm, Applications, and Perspectives · 2018 · 35510.1201/9780429424878-14 ↗

29. S. A. Asadollah, “Cyberattacks: Modeling, analysis, and mitigation,” presented at the 6th Int. Conf. Comput., Software Modeling (ICCSM), Barcelona, Spain, Jul. 15–17, 2022.10.1109/ICCSM57214.2022.00021 ↗

30. Building Security IN10.1007/s11623-012-0222-3 ↗

31. K. Tiirik, “Comparison of SDL and Touchpoints,” M.S. thesis, Dept. of Computer Science, Univ. of Tartu, Tartu, Estonia, 2013.

32. On the secure software development process: CLASP, SDL and Touchpoints compared10.1016/j.infsof.2008.01.010 ↗

33. M. -G. Lee, H. Sohn, M. Baek, and J. -B. Kim, “A study on secure SDLC specialized in common criteria,” presented at the Int. Conf. Adv. Sci. Technol. Lett., Jeju Island, Republic of Korea, Dec. 2015.

34. Identification and integration of security activities for secure agile development

35. Systematic literature reviews in software engineering-A systematic literature review10.1016/j.infsof.2008.09.009 ↗

36. C. Onwubiko, “Security operations centre: Situation awareness, threat intelligence and cybercrime,” presented at the Int. Conf. Cyber Situat. Aware., Data Analytics Assess. (Cyber SA), London, UK, Jun. 2017.10.1109/CyberSA.2017.8073384 ↗

37. Successful combination of database search and snowballing for identification of primary studies in systematic literature studies10.1016/j.infsof.2022.106908 ↗

38. Panda · Library Technology with New Perception · 2023 · 191

39. Quality assessment in systematic literature reviews: A software engineering perspective10.1016/j.infsof.2020.106397 ↗

40. J. Shah and N. Kama, “Extending function point analysis effort estimation method for software development phase,” presented at the 7th Int. Conf. Softw. Comput. Appl., Kuantan, Malaysia, Feb. 8–10, 2018.10.1145/3185089.3185137 ↗

41. Citation tools in academic libraries: Best practices for reference and instruction10.5860/rusq.51n2.143 ↗

42. Security risks in the software development lifecycle

43. W. Wang, Q. Zeng, and A. P. Mathur, “A security assurance framework combining formal verification and security functional testing,” presented at the 12th Int. Conf. Qual. Softw., Xi’an, China, Aug. 27–28, 2012.10.1109/QSIC.2012.34 ↗

44. Collaborative security risk estimation in agile software development10.1108/ICS-12-2018-0138 ↗

45. S. -J. Chen, Y. -C. Pan, Y. -W. Ma, and C. -M. Chiang, “The impact of the practical security test during the software development lifecycle,” presented at the 24th Int. Conf. Adv. Commun. Technol. (ICACT), Pyeongchang, Republic of Korea, Feb. 13–16, 2022.10.23919/ICACT53585.2022.9728868 ↗

46. M. G. Stochel, “Reliability and accuracy of the estimation process—Wideband Delphi vs. wisdom of crowds,” presented at the 35th Annual Comput. Softw. Appl. Conf., Munich, Germany, Jul. 18–22, 2011.10.1109/COMPSAC.2011.53 ↗

47. Y. Zeng, Y. Cheng, G. Xie, and R. Wang, “Design of mobile application lifecycle security management platform,” presented at the Int. Conf. Comput. Netw., Electron. Autom. (ICCNEA), Xi’an, China, Dec. 10–12, 2021.10.1109/ICCNEA53019.2021.00017 ↗

48. A framework of information security integrated with human factors

49. O. Kovalenko, O. Smirnov, A. Kovalenko, and S. Kavun, “Quantitative risk assessment method development in the context of the SDLC-model,” presented at the 8th Int. Conf. Probl. Info Commun., Sci Technol. (PIC S&T), Kharkiv, Ukraine, Oct. 5–8, 2021.10.1109/PICST54195.2021.9772143 ↗

50. Analysis of software effort estimation by machine learning techniques

51. A. S. Farhan and G. M. Mostafa, “A methodology for enhancing software security during development processes,” presented at the 21st Saudi Comput. Soc. Natl. Comput. Conf. (NCC), Riyadh, Saudi Arabia, Apr. 25–26, 2018.

52. Secure software development practice adoption model: A Delphi study

53. M. Gutfleisch, M. Schöps, S. A. Horstmann, D. Wichmann, and M. A. Sasse, “Security champions without support: Results from a case study with OWASP SAMM in a large-scale e-commerce enterprise,” presented at the 2023 Eur. Symp. Usable Secur., Barcelona, Spain, Jun. 12–14, 2023.10.1145/3617072.3617115 ↗

54. Z. A. Maher, H. Shaikh, M. S. Khan, A. Arbaaeen, and A. Shah, “Factors affecting secure software development practices among developers—An investigation,” presented at the 5th Int. Conf. Eng. Technol. Appl. Sci. (ICETAS), Bangkok, Thailand, Nov. 22–23, 2018.10.1109/ICETAS.2018.8629168 ↗

55. M. Alhamed and T. Storer, “Playing planning poker in crowds: Human computation of software effort estimates,” presented at the IEEE/ACM 43rd Int. Conf. Softw. Eng. (ICSE), Madrid, Spain, May 25–28, 2021.10.1109/ICSE43902.2021.00014 ↗

56. N. Ziems and S. Wu, “Security vulnerability detection using deep learning natural language processing,” presented at the IEEE INFOCOM 2021-IEEE Conf. Comput. Commun. Workshops (INFOCOM WKSHPS), Vancouver, BC, Canada, May 10–13, 2021.10.1109/INFOCOMWKSHPS51825.2021.9484500 ↗

57. P. Kadebu, V. Thada, and P. Chiurunge, “Natural language processing and deep learning towards security requirements classification,” presented at the 3rd Int. Conf. Contemp. Comput. Inform. (IC3I), Gurgaon, India, Dec. 27–29, 2018.10.1109/IC3I44769.2018.9007300 ↗

58. C. A. Cois and R. Kazman, “Natural language processing to quantify security effort in the software development lifecycle,” presented at the Int. Conf. Softw. Eng. Knowl. Eng. (SEKE), Pittsburgh, PA, USA, Jul. 6–8, 2015.

59. Automatically detect software security vulnerabilities based on natural language processing techniques and machine learning algorithms

60. K. Singh, S. S. Grover, and R. K. Kumar, “Cyber security vulnerability detection using natural language processing,” presented at the IEEE World AI IoT Congr. (AIIoT), Seattle, WA, USA, May 5–9, 2022.10.1109/AIIoT54504.2022.9817336 ↗

61. M. Wang, L. Xu, and L. Guo, “Anomaly detection of software system logs based on natural language processing,” presented at the Int. Conf. Image Video Process. Artif. Intell., Honolulu, HI, USA, Jul. 12–15, 2018, vol. 10836.10.1117/12.2513857 ↗

62. Software security with natural language processing and vulnerability scoring using machine learning approach10.1007/s12652-024-04778-y ↗

63. Natural language processing: Security-and defense-related lessons learned

64. Systematic review of software risk assessment and estimation models

65. I. A. Tøndel, M. G. Jaatun, D. Cruzes, and T. D. Oyetoyan, “Understanding challenges to adoption of the protection poker software security game,” presented at the ESORICS 2018 Int. Workshops, Barcelona, Spain, Sep. 6–7, 2018.10.1007/978-3-030-12786-2_10 ↗

66. A. Olmsted, “Secure software development—Models, tools, architectures and algorithms,” presented at the 11th Int. Conf. Emerg. Secur. Inf., Syst. Technol. (SECURWARE), Barcelona, Spain, Oct. 23–27, 2017.

67. M. G. Jaatun and I. A. Tøndel, “Playing protection poker for practical software security,” presented at the Product-Focused Softw. Process Improv.: 17th Int. Conf., PROFES 2016, Trondheim, Norway, Nov. 22–24, 2016.10.1007/978-3-319-49094-6_55 ↗

68. H. Rygge and A. Jøsang, “Threat poker: Solving security and privacy threats in agile software development,” presented at the 23rd Nordic Conf. Secure IT Systems (NordSec 2018), Oslo, Norway, Nov. 28–30, 2018, pp. 468–483.10.1007/978-3-030-03638-6_29 ↗

69. The consistency analysis of failure mode and effect analysis (FMEA) in information technology risk assessment10.1016/j.heliyon.2020.e03161 ↗

70. M. Da Silva, M. Puys, P. -H. Thevenon, S. Mocanu, and N. Nkawa, “Automated ICS template for STRIDE Microsoft threat modeling tool,” presented at the 18th Int. Conf. Availab., Reliab. Secur. (ARES), Benevento, Italy, Aug. 28–30, 2023.10.1145/3600160.3605068 ↗

71. Modeling threats to AI-ML systems using STRIDE10.3390/s22176662 ↗

72. Recommendation of machine learning techniques for software effort estimation using multi-criteria decision making

73. A case study research on software cost estimation using experts’ estimates, wideband Delphi, and planning poker technique

74. W. S. Ismail, “Threat detection and response using AI and NLP in cybersecurity,” presented at the 2020 Int. Conf. Cybersecurity Priv., New York, NY, USA, Jul. 22–25, 2020.

75. Advancing cybersecurity: A comprehensive review of AI-driven detection techniques10.1186/s40537-024-00957-y ↗

76. Artificial intelligence and machine learning in dynamic cyber risk analytics at the edge10.1007/s42452-020-03559-4 ↗

77. A machine learning approach for the NLP-based analysis of cyber threats and vulnerabilities of the healthcare ecosystem10.3390/s23020651 ↗

78. A comprehensive review and assessment of cybersecuri vulnerability detection methodologies10.3390/jcp4040040 ↗

79. A. A. Ardo, J. M. Bass, and T. Gaber, “Towards secure agile software development process: A practice-based model,” presented at the 48th Euromicro Conf. Softw. Eng. Adv. Appl. (SEAA), Porto, Portugal, Sep. 2–5, 2022. doi: 10.1109/SEAA56994.2022.00031.10.1109/SEAA56994.2022.00031 ↗

80. Software effort estimation modeling and fully connected artificial neural network optimization using soft computing techniques10.1007/s10586-023-03979-y ↗

81. S. Bilgaiyan, S. Mishra, and M. Das, “A review of software cost estimation in agile software development using soft computing techniques,” presented at the 2nd Int. Conf. Comput. Intell. Netw. (CINE), Bhubaneswar, India, Jan. 23–24, 2016. doi: 10.1109/CINE.2016.27.10.1109/CINE.2016.27 ↗

82. W. G. Johnson and C. L. Cheng, “A survey of software effort estimation techniques using machine learning research-oriented,” presented at the 10th Int. Conf. Predictive Models Softw. Eng., Denver, CO, USA, Sep. 19–20, 2017.

83. P. Brar and D. Nandal, “A systematic literature review of machine learning techniques for software effort estimation models,” presented at the Fifth Int. Conf. Comput. Intell. Commun. Technol. (CCICT), Ghaziabad, India, Feb. 25–26, 2022, pp. 494–499.10.1109/CCiCT56684.2022.00093 ↗

84. A survey on software estimation techniques in traditional and agile development models

85. F. B. Ahmad and L. M. Ibrahim, “Software development effort estimation techniques using long short-term memory,” presented at the Int. Conf. Comput. Sci. Softw. Eng. (CSASE), Duhok, Iraq, Apr. 12–13, 2022.10.1109/CSASE51777.2022.9759751 ↗

86. Software defect prediction using hybrid model (CBIL) of convolutional neural network (CNN) and bidirectional long short-term memory (Bi-LSTM)10.7717/peerj-cs.739 ↗

87. An improving long short-term memory-grid search-based deep learning neural network for software effort estimation

88. N. Rankovic and D. Rankovic, “Power of LSTM and SHAP in the use case point approach for software effort and cost estimation,” presented at the IEEE 22nd World Symp. Appl. Mach. Intell. Inform. (SAMI), Herľany, Slovakia, Jan. 24–26, 2024. doi: 10.1109/SAMI60510.2024.10432878.10.1109/SAMI60510.2024.10432878 ↗

89. Empirical assessment of machine learning techniques for software requirements risk prediction10.3390/electronics10020168 ↗

90. A deep learning method to mitigate the impact of subjective factors in risk estimation for machinery safety

91. M. Awais and A. A. Malik, “A comparative analysis of popular software effort estimation techniques,” presented at the Int. Conf. IT Ind. Technol. (ICIT), Karachi, Pakistan, Mar. 12–14, 2023.10.1109/ICIT59216.2023.10335868 ↗

92. An optimized neuro-fuzzy network for software project effort estimation10.1080/03772063.2022.2027282 ↗

93. Software development effort estimation techniques: A survey10.33899/edusj.2022.132274.1201 ↗

94. A. Kialbekov, “Empirical study on commonly used combinations of estimation techniques in software development planning,” presented at the Euro. Symp. Softw. Eng. (ESSE 2020), Cambridge, UK, Nov. 5–6, 2020.10.1145/3393822.3432328 ↗

95. V. Chahar and P. K. Bhatia, “Unveiling the art of software testing effort estimation: An in-depth study of current techniques and their analysis,” presented at the Int. Conf. Adv. Comput. Commun. Technol. (ICACCTech), Dehradun, India, Jan. 15–17, 2023.10.1109/ICACCTech61146.2023.00018 ↗

96. J. Lande, N. Tejaswini, H. M. Al-Jawahry, P. Lekshmy, and M. Sridevi, “Automatic software vulnerability analysis through a multi-head attention and long short-term memory approach,” presented at the Int. Conf. Integr. Circuits Commun. Syst. (ICICACS), Hyderabad, India, Mar. 6–8, 2024.10.1109/ICICACS60521.2024.10499176 ↗

97. M. A. Mateen and A. A. Malik, “A comparative study of the accuracy and efficiency of wideband Delphi and planning poker software effort estimation techniques,” presented at the Int. Conf. IT Ind. Technol. (ICIT), Karachi, Pakistan, Mar. 12–14, 2023.10.1109/ICIT59216.2023.10335782 ↗

98. F. Calefato and F. Lanubile, “A planning poker tool for supporting collaborative estimation in distributed agile development,” presented at the 6th Int. Conf. Softw. Eng. Adv. (ICSEA), Barcelona, Spain, Oct. 23–28, 2011.

99. F. Osses, G. Márquez, C. Orellana, and H. Astudillo, “Towards the selection of security tactics based on non-functional requirements: Security tactic planning poker,” presented at the 36th Int. Conf. Chil. Comput. Sci. Soc. (SCCC), Arica, Chile, Oct. 16–20, 2017, pp. 1–8. doi: 10.1109/SCCC.2017.8405144.10.1109/SCCC.2017.8405144 ↗

100. Software effort estimation using machine learning techniques