A position study to investigate technical debt associated with security weaknesses
A position study to investigate technical debt associated with security weaknesses
复制标题
调查与安全弱点相关的技术债务的立场研究
DOI：
10.1145/3194164.3194167
复制
发表时间：
2018
期刊：
影响因子：
--
通讯作者：
Valentien, Tessa
中科院分区：
文献类型：
--
作者：
Izurieta, Clemente;Rice, David;Kimball, Kali;Valentien, Tessa
管理与设计期间发现的潜在安全漏洞相关的技术债务（TD）可能导致捕获漏洞（即，可利用的弱点）;因此，预计TD本金和利息可能会对业务产生决定性的负面影响。目标通过利用共同弱点枚举（CWE）及其评分机制，建立一种帮助评估与安全弱点相关的TD的方法，常见弱点评分系统（CWSS）。方法我们提出了一个位置的研究与五个-一步的方法采用Quamoco质量模型来操作评分的建筑CWEs.ResultsWe使用静态分析来检测设计水平的CWEs，计算他们的CWSS分数，并提供弱点的相对排名，以帮助从业者识别组织中可能影响TD的最高风险。结论CWSS是一种社区商定的方法，应利用该方法帮助提供排名信息安全相关的TD项目。
ContextManaging technical debt (TD) associated with potential security breaches found during design can lead to catching vulnerabilities (i.e., exploitable weaknesses) earlier in the software lifecycle; thus, anticipating TD principal and interest that can have decidedly negative impacts on businesses.GoalTo establish an approach to help assess TD associated with security weaknesses by leveraging the Common Weakness Enumeration (CWE) and its scoring mechanism, the Common Weakness Scoring System (CWSS).MethodWe present a position study with a five-step approach employing the Quamoco quality model to operationalize the scoring of architectural CWEs.ResultsWe use static analysis to detect design level CWEs, calculate their CWSS scores, and provide a relative ranking of weaknesses that help practitioners identify the highest risks in an organization with a potential to impact TD.ConclusionCWSS is a community agreed upon method that should be leveraged to help inform the ranking of security related TD items.