Abstract

Organizations creating software commonly utilize software development lifecycles (SDLCs) to structure development activities. Secure development lifecycles (SDLs) integrate into SDLCs, adding security or compliance activities. They are widely used and have been published by industry leaders and in literature. These SDLs, however, were mostly designed before or while cloud services and other hosted solutions became popular. Such offerings widen the provider’s responsibilities, as they not only deliver software but operate and decommission it as well. SDLs, however, do not always account for this change. Security maturity models (SMMs) help to assess SDLs and identify improvements by introducing a baseline to compare against. Multiple of these models were created after the advent of hosted solutions and are more recent than commonly referenced SDLs. Recent SMMs and SDLs may therefore support hosted solutions better than older proposals do. This paper compares a set of current and historic SDLs and SMMs in order to review their support for hosted solutions, including how support has changed over time. Security, privacy, and support for small or agile organizations are considered, as all are relevant to hosted solutions. The SDLs analyzed include Microsoft’s SDL, McGraw’s Touchpoints, the Cisco’s SDL, and Stackpole and Oksendahl’s SDL ² . The SMMs reviewed are OWASP’s Software Assurance Maturity Model 2 and DevSecOps Maturity Model. To assess the support for hosted solutions, the security and privacy activities foreseen in each SDLC phase are compared, before organizational compatibility, activity relevance, and efficiency are assessed. The paper further demonstrates how organizations may select and adjust a suitable proposal. The analyzed proposals are found to not sufficiently support hosted solutions: Important SDLC phases, such as solution retirement, are not always sufficiently supported. Agile practices, such as working in sprints, and small organizations are often not sufficiently considered as well. Efficiency is found to vary based on the application context. A clear improvement trend from before the proliferation of hosted solutions cannot be identified. Future work is therefore found to be required.

Authors: Felix Lange, Immanuel Kunz

Published on: Journal of Software: Evolution and Process

DOI: http://dx.doi.org/10.1002/smr.2711

Abstract

In increasingly dynamic threat landscapes, automated Risk Assessment emerges as an essential approach, highlighting the benefits of enhanced accuracy and operational efficiency in addressing threats. This work combines Attack Graphs with the Open Security Controls Assessment Language (OSCAL), employing compliance-as-code for enforceable, machine-readable security modeling. Utilizing Domain-Specific Languages (DSLs), we aim to simplify the creation and enforcement of security measures, establish connections between components and controls, and uses graph-based algorithms for risk assessment, risk mitigation, and asset management in line with OSCAL standards and requirements. Such approaches aim to streamline RA process, providing real-time insights and allowing for quicker, more efficient decision-making regarding threat mitigation and security measures, without the need for extensive manual intervention.

Authors: Ioannis Koufos, Maria Christopoulou, George Xilouris, Michael-Alexandros Kourtis, Maria Souvalioti, Panagiotis Trakadas

Published on: Distributed Computing and Artificial Intelligence, Special Sessions I, 20th International Conference

DOI: http://dx.doi.org/10.1007/978-3-031-76459-2_30

Abstract

This paper presents optical networks using Network Digital Twins (NDT) integrated with
cloud-native SDN controllers and intent based networking with generative AI. The framework optimizes
network design, automation, and maintenance, enhancing efficiency and performance.

Authors: Ricard Vilalta, Allen Abishek, Lluis Gifre, Ramon Casellas, Ricardo Martínez, Raul Muñoz

Published on: ECOC 2024

DOI:

Abstract

The advent of MEC (Multi-access Edge Computing), as a natural evolution of cloud computing, can enable innovative services and applications, with many opportunities for end users. Hosting applications at the edge could also address privacy and security issues inherent to the traditional cloud-based deployment model, e.g., keeping regional regulatory compliance. However, shifting workloads to the edge of the network warrants the consideration of new security risks. Separately, the recent specification of MEC federations (as result of the GSMA’s Telco Edge Cloud) underscores the importance of security and trust due to the heterogeneity of edge systems in global MEC deployments. Edge cybersecurity solutions must adopt international standards for interoperability. Accordingly, ETSI MEC has endeavored to study edge security threats and craft solutions, oftentimes based on existing standards from other industry groups. This paper discusses the security challenges that arise from shifting workloads to the edge of the network with particular emphasis on international standards and aims to provide a tutorial for developers and architects to navigate the complexities in achieving edge computing security.

Authors: Dario Sabella, Kishen Maloor, Ned Smith, Michaela Vanderveen, Akis Kourtis

Published on: ECOC 2024

DOI: http://dx.doi.org/10.1109/ACCESS.2024.3506212