ITI42220 Security in Information Systems and Software Engineering (Spring 2022)

Second semester (spring) in the full-time programme.

Second or fourth semester (spring) in the part-time programme.

1. Security in Requirements: Development and Acquisition
2. Security Engineering Risk Analysis
3. DevSecOps: Strategy and Implementation

Knowledge

The student

• knows how to specify and analyse security requirements in the development and acquisition process
• understands the differences between security concerns in software acquisition and development environments
• is able to recognize common security engineering risk analysis tools and methods
• knows main secure design considerations
• is able to understand main testing approaches for security
• is familiar with common DevSecOps toolchains and configurations
• is able to identify and understand maturity models in security and DevSecOps scenarios

Skills

The student is

• able to use common security requirements engineering methods (e.g. MSRA, SQUARE, GBRAM…) in real settings
• able to perform a security risk analysis
• able to justify the need of DevSecOps approaches and guide them in practical business settings
• able to secure DevOps scenarios
• able to introduce security in software design and coding phases
• able to use main testing approaches with an accent in security
• capable of using a set of DevSecOps software tools for business needs
• able to measure security levels by means of metrics and models

General competence

The student is able to apply theories and methodologies in the course in a practical business setting.

The student must deliver up to four assignments.

Coursework requirements must be accepted to qualify for the exam.

Individual written exam and scientific paper

The exam is divided into two parts:

• Individual written exam (50%) based on the course curriculum. Duration 4 hours. No supporting materials allowed.
• Scientific paper (50%) on a topic related to the course. The topic is chosen by the students and agreed with the course responsible. The paper can be developed individually or in groups of two students. The students will get an individual grade.

Grading scale A - F in both parts. Both parts of the exam must be passed to pass the course. The student will get an individual joint grade for the entire course.

This course is evaluated by a:

• Mid-term evaluation (compulsory)

The responsible for the course compiles a report based on the feedback from the students and his/her own experience with the course. The report is discussed by the study quality committee of the faculty of Computer Sciences.

Last updated 21.10.2020. The reading list may be subject to changes before the 1st of December 2021.

Ahmed, Z., & Francis, S. C. (2019, November). Integrating Security with DevSecOps: Techniques and Challenges. In 2019 International Conference on Digitization (ICD) (pp. 178-182). IEEE.

Carter, K. (2017). Francois raynaud on DevSecOps. IEEE Software, 34(5), 93-96.

Hsu, T. H. C. (2018). Hands-On Security in DevOps: Ensure continuous security, deployment, and delivery with DevSecOps. Packt Publishing Ltd.

https://insights.sei.cmu.edu/devops/

https://insights.sei.cmu.edu/sei_blog/2018/12/threat-modeling-12-available-methods.html

Kumar, R., & Goyal, R. (2020). Modeling continuous security: A conceptual model for automated DevSecOps using open-source software over cloud (ADOC). Computers & Security, 97, 101967.

McGraw, G., Bonett, R., Figueroa, H., & Shepardson, V. (2019). Security Engineering for Machine Learning. Computer, 52(8), 54-57.

Mead, N. R., & Woody, C. (2016). Cyber Security Engineering: A Practical Approach for Systems and Software Assurance. Addison-Wesley Professional.

Mead, N. R. (2007). How to compare the Security Quality Requirements Engineering (SQUARE) method with other methods. CARNEGIE-MELLON UNIV PITTSBURGH PA SOFTWARE ENGINEERING INST.

Merkow, M. (2019). Secure, Resilient, and Agile Software Development. CRC Press.

Morales, J., Turner, R., Miller, S., Capell, P., Place, P., & Shepard, D. J. (2020). Guide to Implementing DevSecOps for a System of Systems in Highly Regulated Environments. Software Engineering Institute.

Myrbakken, H., & Colomo-Palacios, R. (2017). DevSecOps: a multivocal literature review. In International Conference on Software Process Improvement and Capability Determination (pp. 17-29). Springer, Cham.

O'Connor, R.V., & Colomo-Palacios, R. (2018). Security Awareness in the Software Arena. In Engemann, K. (Eds.). The Routledge Companion to Risk, Crisis and Security in Business. :Routledge.

Sánchez-Gordón, M., & Colomo-Palacios, R. (2020). Security as Culture: A Systematic Literature Review of DevSecOps. In Proceedings of the IEEE/ACM 42nd International Conference on Software Engineering Workshops (pp. 266-269).