Towards the Integration of Security Practices in Agile Software Development: A Systematic Mapping Review
Source abstract
Abstract
Software development must be based on more than just the experience and capabilities of your programmers and your team. The importance of obtaining a quality product lies in the risks that can be exploited by software vulnerabilities, which can jeopardize organizational assets, consumer confidence, operations, and a broad spectrum of applications. Several methods, techniques, and models have been suggested and developed to address software security. However, only a few have solid evidence for creating secure software applications. The main objective of this paper is to survey the literature for methods or models suitable for considering the integration of security in all or some of the phases of the software development life cycle and which ones are most considered or neglected. This study represents the beginning of research to generate a methodology that integrates security practices in agile software development, allowing inexperienced developers to create more secure applications.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Software Engineering Research · Information and Cyber Security · Software Engineering Techniques and Practices
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Universidad Autónoma de Chile, 5 Poniente, Talca 1670, Chile
Universidad de La Frontera, Francisco Salazar, Temuco 01145, Chile
Universidad Tecnológica de México, Marina Nacional 180, Anahuác I Sección, Ciudad de México 11320, Mexico
Universidad Americana de Europa, Av. Bonampak Sm. 6-Mz. 1, Lt. 1, Cancún, Quintana Roo 77500, Mexico
Funding
Proyecto DIUFRO DI22-0043 Universidad de La Frontera, Temuco, Chile · Grant ANID, Chile, Fondecyt de Iniciación en investigación
References (100+)
Show source-provided references
1. Smart grid communication and information technologies in the perspective of Industry 4.0: Opportunities and challenges10.1016/j.cosrev.2018.08.001 ↗
2. Lee, M., Yun, J.J., Pyka, A., Won, D., Kodama, F., Schiuma, G., Park, H., Jeon, J., Park, K., and Jung, K. (2018). How to respond to the fourth industrial revolution, or the second information technology revolution? Dynamic new combinations between technology, market, and society through open innovation. J. Open Innov. Technol. Mark. Complex., 4.10.3390/joitmc4030021 ↗
3. Liou, J.C., and Duclervil, S.R. (2020). Innovations in Cybersecurity Education, Springer.
4. From the ground up: The DIMACS software security workshop10.1109/MSECP.2003.1193213 ↗
5. Castellaro, M., Romaniz, S., Ramos, J.C., Feck, C., and Gaspoz, I. (2016, January 22–24). Aplicar el Modelo de Amenazas para incluir la Seguridad en el Modelado de Sistemas. Proceedings of the V Congreso Iberoamericano de Seguridad Informática—CIBSI, Bogota, Colombia.
6. Procedimiento para la seguridad del proceso de despliegue de aplicaciones web
7. Pecka, N.S. (2022). Making Secure Software Insecure without Changing Its Code: The Possibilities and Impacts of Attacks on the DevOps Pipeline. [Ph.D. Thesis, Iowa State University].
8. Life cycle and life cycle cost implications of integrated phase change materials in office buildings10.1002/er.4238 ↗
9. Symantec (2023, February 23). Symantec. Internet Security Threat Report. Available online: https://www.symantec.com/security-center/threatreport.
10. Diéguez, M., and Cares, C. (2017, January 11–13). Anticipation models (anti-models) for a proactive cyber defence. Proceedings of the IX Congreso Internacional de Computación y Telecomunicaciones, Lima, Peru.
11. ISO (2023, February 23). ISO/IEC27001. Information Security Management. Available online: https://www.iso.org/standard/82875.html.
12. ISO (2023, February 20). NIST, Cybersecurity. Available online: http://www.iso.org/iso/catalogue_detail?csnumber=54533.
13. ISACA (2023, February 21). Control Objectives for Information and Related Technologies (Cobit). Available online: http://www.isaca.org/KnowledgeCenter/cobit/Pages/Products.aspx.
14. Information security management in SMEs: Factors of success
15. System security requirements: A framework for early identification, specification and measurement of related software requirements10.1016/j.csi.2019.04.005 ↗
16. STORE: Security threat oriented requirements engineering methodology
17. Internet of things applications, security challenges, attacks, intrusion detection, and future visions: A systematic review10.1109/ACCESS.2021.3073408 ↗
18. Metodologías de desarrollo de software seguro con propiedades agiles
19. Software vulnerabilities in TensorFlow-based deep learning applications10.1016/j.cose.2022.102948 ↗
20. On cloud security requirements, threats, vulnerabilities and countermeasures: A survey10.1016/j.cosrev.2019.05.002 ↗
21. Adaption of a secure software development methodology for secure engineering design10.1109/ACCESS.2020.3007355 ↗
22. García-Peñalvo, F. (2018). Proyecto Docente e Investigador. Catedrático de Universidad. Perfil Docente: Ingeniería del Software y Gobierno de Tecnologías de la Información. Perfil Investigador: Tecnologías del Aprendizaje. Área de Ciencia de la Computación e Inteligencia Artificial, Grupo GRIAL. Technical Report.
23. De Vicente Mohino, J., Bermejo Higuera, J., Bermejo Higuera, J.R., and Sicilia Montalvo, J.A. (2019). The application of a new secure software development life cycle (S-SDLC) with agile methodologies. Electronics, 8.10.3390/electronics8111218 ↗
24. A survey on design methods for secure software development10.24297/ijct.v16i7.6467 ↗
25. Ramirez, A., Aiello, A., and Lincke, S.J. (2020, January 26–27). A survey and comparison of secure software development standards. Proceedings of the 2020 13th CMI Conference on Cybersecurity and Privacy (CMI)—Digital Transformation-Potentials and Challenges (51275), Copenhagen, Denmark.10.1109/CMI51275.2020.9322704 ↗
26. Rindell, K., Hyrynsalmi, S., and Leppänen, V. (2021). Research Anthology on Recent Trends, Tools, and Implications of Computer Programming, IGI Global.
27. McGraw, G. (2023, February 22). Security Software Building Security in Seven Touchpoints for Software Security. Available online: http://www.swsec.com/resources/touchpoints/.
28. Sinha, A., and Das, P. (2021, January 4–5). Agile methodology vs. traditional waterfall SDLC: A case study on quality assurance process in software industry. Proceedings of the 2021 5th International Conference on Electronics, Materials Engineering & Nano-Technology (IEMENTech), Kolkata, India.10.1109/IEMENTech53263.2021.9614779 ↗
29. Futcher, L., and von Solms, R. (2012, January 6–8). SecSDM: A usable tool to support IT undergraduate students in secure software development. Proceedings of the HAISA, Crete, Greece.
30. The agile manifesto
31. Croxford, M., and Chapman, R. (2005). Correctness by construction: A manifesto for high-integrity software. J. Def. Soft. Eng., 5–8.
32. Metodologías para desarrollar software seguro
33. Lindo, A.C. (2023, February 23). AC Modelos de Desarrollo Seguro del Software. Available online: https://web.fdi.ucm.es/posgrado/conferencias/AndresCaroLindo-slides.pdf.
34. A preventive secure software development model for a software factory: A case study10.1109/ACCESS.2020.2989113 ↗
35. Microsoft (2023, February 27). SDL—Agile Requirements. Available online: https://learn.microsoft.com/en-us/previous-versions/windows/desktop/ee790620(v=msdn.10)?redirectedfrom=MSDN.
36. BSIMM (2023, February 27). BSIMM Frameworks. Available online: https://www.bsimm.com/.
37. Chechik, M., Salay, R., Viger, T., Kokaly, S., and Rahimi, M. (2019, January 6–11). Software assurance in an uncertain world. Proceedings of the Fundamental Approaches to Software Engineering: 22nd International Conference, FASE 2019, Held as Part of the European Joint Conferences on Theory and Practice of Software, ETAPS 2019, Prague, Czech Republic.10.1007/978-3-030-16722-6_1 ↗
38. Tawalbeh, L., Muheidat, F., Tawalbeh, M., and Quwaider, M. (2020). IoT Privacy and security: Challenges and solutions. Appl. Sci., 10.10.3390/app10124102 ↗
39. Beznosov, K., and Kruchten, P. (2004, January 20–23). Towards agile security assurance. Proceedings of the 2004 Workshop on New Security Paradigms, Virtual.10.1145/1065907.1066034 ↗
40. Collaborative security risk estimation in agile software development10.1108/ICS-12-2018-0138 ↗
41. Oueslati, H., Rahman, M.M., and ben Othmane, L. (2015, January 24–28). Literature review of the challenges of developing secure software using the agile approach. Proceedings of the 2015 10th International Conference on Availability, Reliability and Security, Toulouse, France.10.1109/ARES.2015.69 ↗
42. Bhasin, S. (2012, January 17–19). Quality assurance in agile: A study towards achieving excellence. Proceedings of the 2012 Agile India, Bengaluru, India.10.1109/AgileIndia.2012.18 ↗
43. Newton, N., Anslow, C., and Drechsler, A. (2019, January 8–14). Information security in agile software development projects: A critical success factor perspective. Proceedings of the 27th European Conference on Information Systems (ECIS), Uppsala, Sweden.10.26686/wgtn.13088357 ↗
44. Security in agile software development: A practitioner survey10.1016/j.infsof.2020.106488 ↗
45. Developmental test and requirements: Best practices of successful information systems using agile methods
46. An efficient approach for reviewing security-related aspects in agile requirements specifications of web applications10.1007/s00766-020-00338-w ↗
47. Identification and integration of security activities for secure agile development
48. Bodden, E. (June, January 27). State of the systems security. Proceedings of the 40th International Conference on Software Engineering: Companion Proceeedings, New York, NY, USA.
49. Ancán Bastías, O., Díaz, J., and López Fenner, J. (2023). Exploring the Intersection between Software Maintenance and Machine Learning—A Systematic Mapping Study. Appl. Sci., 13.10.3390/app13031710 ↗
50. Evaluation of critical thinking in online software engineering teaching: A systematic mapping study10.1109/ACCESS.2021.3135245 ↗
51. Evaluating performance of Web application security through a fuzzy based hybrid multi-criteria decision-making approach: Design tactics perspective10.1109/ACCESS.2020.2970784 ↗
52. Fernandez, E.B., Astudillo, H., and Pedraza-García, G. (2015, January 7–11). Revisiting architectural tactics for security. Proceedings of the Software Architecture: 9th European Conference, ECSA 2015, Dubrovnik/Cavtat, Croatia.
53. A security specific knowledge modelling approach for secure software engineering10.4038/jnsfsr.v48i1.8950 ↗
54. On the adoption of static analysis for software security assessment–A case study of an open-source e-government project10.1016/j.cose.2021.102470 ↗
55. An empirical study of developers’ discussions about security challenges of different programming languages10.1007/s10664-021-10054-w ↗
56. Antal, G., Keleti, M., and Hegedŭs, P. (2020, January 29–30). Exploring the security awareness of the python and javascript open source communities. Proceedings of the 17th International Conference on Mining Software Repositories, Seoul, Republic of Korea.10.1145/3379597.3387513 ↗
57. Hybrid Security Assessment Methodology for Web Applications
58. Adopting threat modelling in agile software development projects10.1016/j.jss.2021.111090 ↗
59. Villamizar, H., Kalinowski, M., Viana, M., and Fernández, D.M. (2018, January 29–31). A systematic mapping study on security in agile requirements engineering. Proceedings of the 2018 44th Euromicro conference on software engineering and advanced applications (SEAA), Prague, Czech Republic.10.1109/SEAA.2018.00080 ↗
60. Interventions for long-term software security: Creating a lightweight program of assurance techniques for developers
61. Butler, N. (2023, February 27). Security in Agile Software Development: A Simple Guide: Bigger Impact. Available online: https://www.boost.co.nz/blog/2022/02/security-in-agile-software-development#who-the-guide-is-for.
62. Veracode (2023, February 27). Agile Security. Available online: https://www.boost.co.nz/blog/2022/02/security-in-agile-software-development#who-the-guide-is-for.
63. Security, L. (2023, February 27). 10 Agile Software Development Security Concerns You Need to Know. Available online: https://www.legitsecurity.com/blog/10-agile-software-development-security-concerns-you-need-to-know.
64. OWASP (2023, February 27). OWASP Top Ten. Available online: https://owasp.org/www-project-top-ten/.
65. SANS (2023, February 27). Web Application Security Awareness Training. Available online: https://www.sans.org/security-awareness-training/products/specialized-training/developer/?msc=ssa-main-nav.
66. Preferred reporting items for systematic reviews and meta-analyses: The PRISMA statement10.7326/0003-4819-151-4-200908180-00135 ↗
67. Guidelines for conducting systematic mapping studies in software engineering: An update10.1016/j.infsof.2015.03.007 ↗
68. Rindell, K., Hyrynsalmi, S., and Leppänen, V. (2018, January 21–25). Aligning Security Objectives With Agile Software Development. Proceedings of the 19th International Conference on Agile Software Development: Companion, Porto, Portugal.10.1145/3234152.3234187 ↗
69. Security Assurance Model of Software Development for Global Software Development Vendors10.1109/ACCESS.2022.3178301 ↗
70. Automated Risk Management Based Software Security Vulnerabilities Management10.1109/ACCESS.2022.3185069 ↗
71. A novel lightweight solo software development methodology with optimum security practices10.1109/ACCESS.2020.2971000 ↗
72. Agile Approaches for Cybersecurity Systems, IoT and Intelligent Transportation10.1109/ACCESS.2021.3136861 ↗
73. Malek, S., Bagheri, H., Garcia, J., and Sadeghi, A. (2019). Handbook of Software Engineering, Springer.10.1007/978-3-030-00262-6_12 ↗
74. Yang, J., Lodgher, A., and Lee, Y. (2018, January 3–6). Secure modules for undergraduate software engineering courses. Proceedings of the 2018 IEEE Frontiers in Education Conference (FIE), San Jose, CA, USA.10.1109/FIE.2018.8658433 ↗
75. Ardo, A.A., Bass, J.M., and Gaber, T. (2021, January 25–26). An empirical investigation of agile information systems development for cybersecurity. Proceedings of the European, Mediterranean, and Middle Eastern Conference on Information Systems, Dubai, United Arab Emirates.10.1007/978-3-030-95947-0_40 ↗
76. Exploring the intersection between software industry and Software Engineering education-A systematic mapping of Software Engineering Trends10.1016/j.jss.2020.110736 ↗
77. Mallouli, W., Cavalli, A.R., Bagnato, A., and De Oca, E.M. (2020, January 7–9). Metrics-driven DevSecOps. Proceedings of the ICSOFT, Paris, France.10.5220/0009889602280233 ↗
78. A hierarchical model for quantifying software security based on static analysis alerts and software metrics10.1007/s11219-021-09555-0 ↗
79. Kraemer, H.C. (2014). Wiley StatsRef: Statistics Reference Online, Wiley.
80. Elrhaffari, I., and Roudies, O. (2019). Capturing Software Security Practices using CBR: Three Case Studies. Int. J. Adv. Comput. Sci. Appl., 10.10.14569/IJACSA.2019.0101159 ↗
81. Engineering Security Vulnerability Prevention, Detection, and Response10.1109/MS.2018.290110854 ↗
82. A Framework for Teaching Security Design Analysis Using Case Studies and the Hybrid Flipped Classroom
83. ACM SIGMETRICS International Workshop on Critical Infrastructure Network Security10.1145/3305218.3305237 ↗
84. Oveisi, S., Farsi, M., and Moeini, A. (2019, January 28–30). Software Safety Design in requirement analysis phase for a control systems. Proceedings of the 12th International Conference on Engineering & Technology, Athens, Greece.
85. Nguyen, J., and Dupuis, M. Proceedings of the SIGITE ’19: Proceedings of the 20th Annual SIG Conference on Information Technology Education, Tacoma, WA, USA, 3–5 October 2019.
86. Aruna, E., Rama Mohan Reddy, A., and Sunitha, K. (2022). IOT with Smart Systems, Springer.
87. Validation of the SMBC Framework of Security Testing Using Analytic Hierarchy Process
88. Mishra, A.D., and Mustafa, K. (2020, January 12–14). Security requirements specification: A formal method perspective. Proceedings of the 2020 7th International Conference on Computing for Sustainable Global Development (INDIACom), New Delhi, India.10.23919/INDIACom49435.2020.9083691 ↗
89. Abdellatif, L., Chhiba, M., Tabyaoui, A., and Mjihil, O. (2017, January 28–29). MDA Approach for Application Security Integration with Automatic Code Generation from Communication Diagram. Proceedings of the International Conference on Information Technology and Communication Systems, Khouribga, Morocco.10.1007/978-3-319-64719-7_25 ↗
90. A readiness model for security requirements engineering10.1109/ACCESS.2018.2840322 ↗
91. A hybrid model of hesitant fuzzy decision-making analysis for estimating usable-security of software10.1109/ACCESS.2020.2987941 ↗
92. Fuzzy Expert System of Information Security Risk Assessment on the Example of Analysis Learning Management Systems10.1109/ACCESS.2021.3129488 ↗
93. Text categorization approach for secure design pattern selection using software requirement specification10.1109/ACCESS.2018.2883077 ↗
94. Prioritization based taxonomy of DevOps security challenges using PROMETHEE10.1109/ACCESS.2020.2998819 ↗
95. A Crisis Situations Decision-Making Systems Software Development Process With Rescue Experiences10.1109/ACCESS.2020.2981789 ↗
96. Automatic classification method for software vulnerability based on deep neural network10.1109/ACCESS.2019.2900462 ↗
97. Reusable Security Requirements Repository Implementation Based on Application/System Components10.1109/ACCESS.2021.3133020 ↗
98. GMSA: Gathering multiple signatures approach to defend against code injection attacks10.1109/ACCESS.2018.2884201 ↗
99. A Survey on Blockchain Acquainted Software Requirements Engineering: Model, Opportunities, Challenges, and Future Directions10.1109/ACCESS.2022.3171408 ↗
100. Integrating model checking with SysML in complex system safety analysis10.1109/ACCESS.2019.2892745 ↗