Identification of the Impacts of Code Changes on the Security of Software

Date
2019-07-09
Authors
Abdelkhalek, Moataz
Jamil, Ameerah-Muhsina
Ben Othmane, Lotfi
ben Othmane, Lotfi
Major Professor
Advisor
Committee Member
Journal Title
Journal ISSN
Volume Title
Publisher
Altmetrics
Authors
Research Projects
Organizational Units
Journal Issue
Series
Department
Electrical and Computer Engineering
Abstract

Companies develop their software in versions and iterations. Ensuring the security of each additional version using code review is costly and time consuming. This paper investigates automated tracing of the impacts of code changes on the security of a given software. To this end, we use call graphs to model the software code, and security assurance cases to model the security requirements of the software. Then we relate assurance case elements to code through the entry point methods of the software, creating a map of monitored security functions. This mapping allows to evaluate the security requirements that are affected by code changes. The approach is implemented in a set of tools and evaluated using three open-source ERP/E-commerce software applications. The limited evaluation showed that the approach is effective in identifying the impacts of code changes on the security of the software. The approach promises to considerably reduce the security assessment time of the subsequent releases and iterations of software, keeping the initial security state throughout the software lifetime.

Comments

This is a manuscript of a proceeding published as Abdelkhalek, Moataz, Ameerah-Muhsina Jamil, and Lotfi ben Othmane. "Identification of the Impacts of Code Changes on the Security of Software." 2019 IEEE 43rd Annual Computer Software and Applications Conference (COMPSAC): 569-574. DOI: 10.1109/COMPSAC.2019.10268. Posted with permission.

Description
Keywords
Citation
DOI