An Empirical Study on the Relationship between Software Security Skills, Usage and Training Needs in Agile Settings
An Empirical Study on the Relationship between Software Security Skills, Usage and Training Needs in Agile Settings
复制标题
敏捷环境下软件安全技能、使用和培训需求之间关系的实证研究
DOI：
--
复制
发表时间：
2016
期刊：
影响因子：
--
通讯作者：
M. Jaatun
中科院分区：
文献类型：
--
作者：
Tosin Daniel Oyetoyan;D. Cruzes;M. Jaatun
组织认识到保护其资产免受攻击是一项重要的业务。然而，实现足够的安全性需要采取大胆的步骤来处理组织内的安全性实践。在敏捷软件开发世界中，安全工程过程是不可接受的，因为它与敏捷价值观背道而驰。敏捷团队因此以他们自己的方式处理软件安全活动。为了提高敏捷设置中的安全性，需要管理层了解敏捷团队中软件安全活动的当前实践。在本研究中，我们使用调查的方法来调查两个敏捷组织的软件安全使用、能力和培训需求。我们发现：(1)这两个组织在核心软件安全活动中的表现不同，但当考虑到可以用于安全的活动时，它们是相似的(2)无论成本或收益如何，技能驱动所执行的活动类型(3)安全设计被表示为两个组织中所有小组最重要的培训需求(4)在敏捷设置中有效的软件安全采用不是自动的，它需要驱动程序。
Organizations recognize that protecting their assets against attacks is an important business. However, achieving what is adequate security requires taking bold steps to address security practices within the organization. In the Agile software development world, security engineering process is unacceptable as it runs counter to the agile values. Agile teams have thus approached software security activities in their own way. To improve security within agile settings requires that management understands the current practices of software security activities within their agile teams. In this study, we use survey to investigate software security usage, competence, and training needs in two agile organizations. We find that (1) The two organizations perform differently in core software security activities but are similar when activities that could be leveraged for security are considered (2) regardless of cost or benefit, skill drives the kind of activities that are performed (3) Secure design is expressed as the most important training need by all groups in both organizations (4) Effective software security adoption in agile setting is not automatic, it requires a driver.