Security Mismatch

Phil Vachon

DOI: https://doi.org/10.1145/3630746

IF: 22.7

2024-01-25

Communications of the ACM

Abstract:Security must be a business enabler, not a hinderer.

computer science, theory & methods, software engineering, hardware & architecture

What problem does this paper attempt to address?

The Security Jawbreaker

Phil Vachon

DOI: https://doi.org/10.1145/3637829

IF: 22.7

2024-03-26

Communications of the ACM

Abstract:Access to a system should not imply authority to use it. Enter the principle of complete mediation.

computer science, theory & methods, software engineering, hardware & architecture
Planning Security Services for IT Systems

Marie Henderson,Howard Philip Page

DOI: https://doi.org/10.48550/arXiv.1409.5845

2015-03-14

Abstract:Often the hardest job is to get business representatives to look at security as something that makes managing their risks and achieving their objectives easier, with security compliance as just part of that journey. This paper addresses that by making planning for security services a 'business tool'.

Cryptography and Security,Computers and Society
On the Difference between Security and Safety

Vinton G. Cerf

DOI: https://doi.org/10.1145/3656590

IF: 22.7

2024-05-23

Communications of the ACM

Abstract:Safe networking requires us to be skeptical of messages that try to stampede us into action without enough forethought.

computer science, theory & methods, software engineering, hardware & architecture
Contextualising and aligning security metrics and business objectives: A GQM-based methodology

Eleni Philippou,Sylvain Frey,Awais Rashid

DOI: https://doi.org/10.1016/j.cose.2019.101634

2020-01-01

Abstract:Pre-defined security metrics suffer from the problem of contextualisation, i.e. a lack of adaptability to particular organisational contexts – domain, technical infrastructure, stakeholders, business process, etc. Adapting metrics to an organisational context is essential (1) for the metrics to align with business requirements (2) for decision makers to maintain relevant security goals based on measurements from the field. In this paper we propose Symbiosis, a methodology that defines a goal elicitation and refinement process mapping business objectives to security measurement goals via the use of systematic templates that capture relevant context elements (business goals, purpose, stakeholders, system scope). The novel contribution of SYMBIOSIS is the well-defined process, which enforces that (1) metrics align with business objectives via a top-down derivation that refines top-level business objectives to a manageable granularity (2) the impact of metrics on business objectives is explicitly traced via a bottom-up feedback mechanism, allowing an incremental approach where feedback from metrics influences business goals, and vice-versa. In this paper, we discuss the findings from applying Symbiosis to three case studies of known security incidents. Our analysis shows how the aforementioned pitfalls of security metrics development processes affected the outcome of these high-profile security incidents and how Symbiosis addresses such issues.

computer science, information systems
What Software Security Means to Business

Members of the Application Security Industry Consortium (AppSIC)

DOI: https://doi.org/10.1007/s11623-006-0163-9

2006-10-01

Abstract:Software security: we know we want it, we make choices and tradeoffs that have implications for it, yet, in a general sense, it has escaped true definition and defied measurement. Definition and measurement though are sequential, meaning that something must be defined to make any comparisons against it. In a technical sense, many have positioned software security as protecting the confidentiality, integrity and availability of data, resources and sometimes the application itself. This „definition” tries to capture security broadly but in practice the importance of these things — and the value that defending them has to an organization — varies wildly.More important than defining what security is, we need to capture what it means in context, and what it costs. The only definition that really matters to the enterprise then is one that deals with the contextual nature of security, risk, and pain. This paper is an attempt to explore what software security means to enterprises. Its purpose is to lay the foundation for software security metrics that are truly actionable by the business community to help drive security decisions for the software they buy, build, and outsource. The thoughts, ideas, insights and proposals here come from the members of the Application Security Industry Consortium (AppSIC)0, a group of software security executives, researchers, analysts and practitioners from the vendor, enterprise consumer, academic, and analyst communities. Our intention in writing it is to spur debate on the topic, and, through the input of the community, create a foundation upon which to build software security metrics that are meaningful to business.
Enabling Security-Oriented Orchestration of Microservices

Marcela S. Melara,Mic Bowman

DOI: https://doi.org/10.48550/arXiv.2106.09841

2021-06-18

Abstract:As cloud providers push multi-tenancy to new levels to meet growing scalability demands, ensuring that externally developed untrusted microservices will preserve tenant isolation has become a high priority. Developers, in turn, lack a means for expressing and automatically enforcing high-level application security requirements at deployment time. In this paper, we observe that orchestration systems are ideally situated between developers and the cloud provider to address these issues. We propose a security policy framework that enables security-oriented orchestration of microservices by capturing and auditing code properties that are incorporated into microservice code throughout the software supply chain. Orchestrators can leverage these properties to deploy microservices on a node that matches both the developer's and cloud provider's security policy and their resource requirements. We demonstrate our approach with a proof-of-concept based on the Private Data Objects [1] confidential smart contract framework, deploying code only after checking its provenance.

Cryptography and Security
"What Keeps People Secure is That They Met The Security Team": Deconstructing Drivers And Goals of Organizational Security Awareness

Jonas Hielscher,Simon Parkin

2024-04-29

Abstract:Security awareness campaigns in organizations now collectively cost billions of dollars annually. There is increasing focus on ensuring certain security behaviors among employees. On the surface, this would imply a user-centered view of security in organizations. Despite this, the basis of what security awareness managers do and what decides this are unclear. We conducted n=15 semi-structured interviews with full-time security awareness managers, with experience across various national and international companies in European countries, with thousands of employees. Through thematic analysis, we identify that success in awareness management is fragile while having the potential to improve; there are a range of restrictions, and mismatched drivers and goals for security awareness, affecting how it is structured, delivered, measured, and improved. We find that security awareness as a practice is underspecified, and split between messaging around secure behaviors and connecting to employees, with a lack of recognition for the measures that awareness managers regard as important. We discuss ways forward, including alternative indicators of success, and security usability advocacy for employees.

Cryptography and Security
Security in IS and social engineering -- an overview and state of the art

Florence Sèdes

2024-06-17

Abstract:Major transformations related to information technologies affect InformationSystems (IS) that support the business processes of organizations and their actors. Deployment in a complex environment involving sensitive, massive and heterogeneous data generates risks with legal, social and financial impacts. This context of transition and openness makes the security of these IS central to the concerns of organizations. The digitization of all processes and the opening to IoT devices (Internet of Things) has fostered the emergence of a new formof crime, i.e. cybercrime.This generic term covers a number of malicious acts, the majority of which are now perpetrated using social engineering strategies, a phenomenon enabling a combined exploitation of ``human'' vulnerabilities and digital tools. The maliciousness of such attacks lies in the fact that they turn users into facilitators of cyber-attacks, to the point of being perceived as the ``weak link'' of <a class="link-external link-http" href="http://cybersecurity.As" rel="external noopener nofollow">this http URL</a> deployment policies prove insufficient, it is necessary to think about upstream steps: knowing how to anticipate, identifying weak signals and outliers, detect early and react quickly to computer crime are therefore priority issues requiring a prevention and cooperation <a class="link-external link-http" href="http://approach.In" rel="external noopener nofollow">this http URL</a> this overview, we propose a synthesis of literature and professional practices on this subject.

Cryptography and Security,Databases
Secure Software Engineering in the Financial Services: A Practitioners' Perspective

Vivek Arora,Enrique Larios Vargas,Maurício Aniche,Arie van Deursen

DOI: https://doi.org/10.48550/arXiv.2104.03476

2021-04-08

Abstract:Secure software engineering is a fundamental activity in modern software development. However, while the field of security research has been advancing quite fast, in practice, there is still a vast knowledge gap between the security experts and the software development teams. After all, we cannot expect developers and other software practitioners to be security experts. Understanding how software development teams incorporate security in their processes and the challenges they face is a step towards reducing this gap. In this paper, we study how financial services companies ensure the security of their software systems. To that aim, we performed a qualitative study based on semi-structured interviews with 16 software practitioners from 11 different financial companies in three continents. Our results shed light on the security considerations that practitioners take during the different phases of their software development processes, the different security practices that software teams make use of to ensure the security of their software systems, the improvements that practitioners perceive as important in existing state-of-the-practice security tools, the different knowledge-sharing and learning practices that developers use to learn more about software security, and the challenges that software practitioners currently face when it comes to secure their systems.

Software Engineering
A Business Goal Driven Approach for Understanding and Specifying Information Security Requirements

Xiamoneg Su,Damiano Bolzoni,Pascal van Eck

DOI: https://doi.org/10.48550/arXiv.cs/0603129

2006-03-31

Cryptography and Security

Abstract:In this paper we present an approach for specifying and prioritizing information security requirements in organizations. It is important to prioritize security requirements since hundred per cent security is not achievable and the limited resources available should be directed to satisfy the most important ones. We propose to link explicitly security requirements with the organization's business vision, i.e. to provide business rationale for security requirements. The rationale is then used as a basis for comparing the importance of different security requirements. A conceptual framework is presented, where the relationships between business vision, critical impact factors and valuable assets (together with their security requirements) are shown.
A Case Study on a Security Maturity Assessment of a Business-to-Business Electronic Commerce Organization

Shirley A. Becker,Anthony Berkemeyer

DOI: https://doi.org/10.4018/jeco.2004100101

2004-10-01

Journal of Electronic Commerce in Organizations

Abstract:GlobalUBid.com is a B2B (business-to-business) e-commerce company offering excess and obsolete inventory to online customers. GlobalUBid is rapidly expanding into the global online marketplace; but recently, its Web site crashed due to a denial-of-service (DOS) attack. A lack of security awareness at an organizational level has left GlobalUBid’s online system vulnerable to internal and external attacks. Though informal security policies are in place, many employees are not aware of them nor are they enforced on a regular basis. Unsecured aspects of the physical workplace make the organization vulnerable to disgruntled employees, hackers, and unscrupulous competition. GlobalUBid has hired URSecure consultants to conduct a security assessment in uncovering internal and external vulnerabilities. URSecure has made recommendations for improved security, though the organization must develop most of the implementation details. GlobalUBid management recognizes the need for improved security, though there is a concern about the financial implications of implementing a security plan.
Implementation of Security Features in Software Development Phases

Ariessa Davaindran Lingham,Nelson Tang Kwong Kin,Chen Wan Jing,Chong Heng Loong,Fatima-tuz-Zahra

DOI: https://doi.org/10.48550/arXiv.2012.13108

2020-12-24

Abstract:Security holds an important role in a software. Most people are not aware of the significance of security in software system and tend to assume that they will be fine without security in their software systems. However, the lack of security features causes to expose all the vulnerabilities possible to the public. This provides opportunities for the attackers to perform dangerous activities to the vulnerable insecure systems. This is the reason why many organizations are reported for being victims of system security attacks. In order to achieve the security requirement, developers must take time to study so that they truly understand the consequences and importance of security. Hence, this paper is written to discuss how secure software development can be performed. To reach the goal of this paper, relevant researches have been reviewed. Multiple case study papers have been studied to find out the answers to how the vulnerabilities are identified, how to eliminate them, when to implement security features, why do we implement them. Finally, the paper is concluded with final remarks on implementation of security features during software development process. It is expected that this paper will be a contribution towards the aforementioned software security domain which is often ignored during practical application.

Software Engineering
Convergence of Corporate and Information Security

Syed,M. Rahman,Shannon E. Donahue

DOI: https://doi.org/10.48550/arXiv.1002.1950

2010-02-10

Abstract:As physical and information security boundaries have become increasingly blurry many organizations are experiencing challenges with how to effectively and efficiently manage security within the corporate. There is no current standard or best practice offered by the security community regarding convergence; however many organizations such as the Alliance for Enterprise Security Risk Management (AESRM) offer some excellent suggestions for integrating a converged security program. This paper reports on how organizations have traditionally managed asset protection, why that is changing and how to establish convergence to optimize security value to the business within an enterprise.

Cryptography and Security
Security Model For Service-Oriented Architecture

Oldooz Karimi

DOI: https://doi.org/10.48550/arXiv.1108.1314

2011-08-05

Abstract:In this article, we examine how security applies to Service Oriented Architecture (SOA). Before we discuss security for SOA, lets take a step back and examine what SOA is. SOA is an architectural approach which involves applications being exposed as "services". Originally, services in SOA were associated with a stack of technologies which included SOAP, WSDL, and UDDI. This article addresses the defects of traditional enterprise application integration by combining service oriented-architecture and web service technology. Application integration is then simplified to development and integration of services to tackle connectivity of isomerous enterprise application integration, security, loose coupling between systems and process refactoring and optimization.

Software Engineering
Fundamental Challenges in Cybersecurity and a Philosophy of Vulnerability-Guided Hardening

Marcel Böhme

2024-09-03

Abstract:Research in cybersecurity may seem reactive, specific, ephemeral, and indeed ineffective. Despite decades of innovation in defense, even the most critical software systems turn out to be vulnerable to attacks. Time and again. Offense and defense forever on repeat. Even provable security, meant to provide an indubitable guarantee of security, does not stop attackers from finding security flaws. As we reflect on our achievements, we are left wondering: Can security be solved once and for all? In this paper, we take a philosophical perspective and develop the first theory of cybersecurity that explains what precisely and *fundamentally* prevents us from making reliable statements about the security of a software system. We substantiate each argument by demonstrating how the corresponding challenge is routinely exploited to attack a system despite credible assurances about the absence of security flaws. To make meaningful progress in the presence of these challenges, we introduce a philosophy of cybersecurity.

Cryptography and Security,Software Engineering
The Security Dilemma: A Conceptual Analysis

Shiping Tang

DOI: https://doi.org/10.1080/09636410903133050

2010-01-01

Abstract:Critically building upon the work of Herbert Butterfield, John Herz, and Robert Jervis, this article advances a more rigorous definition of the security dilemma. It demonstrates critical implications of the rigorously redefined concept. It examines several influential extensions and expansions of the original concept, showing that most have been inaccurate and misleading, and proposes remedies for correcting the mistakes. Finally, it identifies several areas of future research that may yield important new insights into the dynamics of the security dilemma.
Drivers and barriers for secure hardware adoption across ecosystem stakeholders

Andrew Tomlinson,Simon Parkin,Siraj Ahmed Shaikh

DOI: https://doi.org/10.1093/cybsec/tyac009

2022-01-01

Journal of Cyber Security

Abstract:Abstract The decisions involved in choosing technology components for systems are poorly understood. This is especially so where the choices pertain to system security and countering the threat of cybersecurity attack. Although common in some commercial products, secure hardware chips provide security functions such as authentication, secure execution and integrity validation on system start, and are increasingly deemed to have a role in devices across sectors, such as IoT devices, autonomous vehicle systems and critical infrastructure components. To understand the decisions and opinions regarding the adoption of secure hardware, we conducted 23 semi-structured interviews with senior decision-makers from companies spanning a range of sectors, sizes and supply-chain roles. Our results consider the business propositional drivers, barriers and economic factors that influence the adoption decisions. Understanding these would help those seeking to influence the adoption process, whether as a business decision, or as a trade or national strategy.
From Lemons to Peaches: Improving Security ROI through Security Chaos Engineering

Kelly Shortridge

DOI: https://doi.org/10.1109/SecDev53368.2022.00021

2023-07-08

Abstract:Traditional information security presents a poor ROI: payoffs only manifest when attacks are successfully prevented. In a reality where attacks are inevitable, subpar returns are therefore inevitable. The emerging paradigm of Security Chaos Engineering offers a more remunerative and reliable ROI by minimizing attack impacts and generating valuable evidence to inform continuous improvement of system design and operation.

Cryptography and Security,Software Engineering
Building resilience: The role of enterprise security risk management in developing a resilient organisation

Tim McCreight

2024-01-01

Abstract:Enterprise security risk management (ESRM) has continued to gain global acceptance as a management philosophy for the development and implementation of an enterprise-wide corporate security programme. As organisations continue to rebuild and recover from COVID-19, the value of assessing the resilience of an organisation through regular testing of its response to events has gained prominence. There are opportunities to link the development and implementation of a risk-based approach for designing a security programme, to assessing an organisation's resilience to future events. Organisations can benefit from the complementary approaches of ESRM and organisational resilience once the commonalities are identified and embraced. This paper expands upon the ESRM management approach, linking the concepts of ESRM to the design of a resilient enterprise.
The cyber security threat stops in the boardroom

Tim Scully

Abstract:The attitude that 'it won't happen to me' still prevails in the boardrooms of industry when senior executives consider the threat of targeted cyber intrusions. Not much has changed in the commercial world of cyber security over the past few years; hackers are not being challenged to find new ways to steal companies' intellectual property and confidential information. The consequences of even major security breaches seem not to be felt by the leaders of victim companies. Why is this so? Surely IT security practitioners are seeking new ways to detect and prevent targeted intrusions into companies' networks? Are the consequences of targeted intrusions so insignificant that the captains of industry tolerate them? Or do only others feel the pain of their failure? This paper initially explores the failure of cyber security in industry and contends that, while industry leaders should not be alone in accepting responsibility for this failure, they must take the initiative to make life harder for cyber threat actors. They cannot wait for government leadership on policy, strategy or coordination. The paper then suggests some measures that a CEO can adopt to build a new corporate approach to cyber security.

Security Mismatch

The Security Jawbreaker

Planning Security Services for IT Systems

On the Difference between Security and Safety

Contextualising and aligning security metrics and business objectives: A GQM-based methodology

What Software Security Means to Business

Enabling Security-Oriented Orchestration of Microservices

"What Keeps People Secure is That They Met The Security Team": Deconstructing Drivers And Goals of Organizational Security Awareness

Security in IS and social engineering -- an overview and state of the art

Secure Software Engineering in the Financial Services: A Practitioners' Perspective

A Business Goal Driven Approach for Understanding and Specifying Information Security Requirements

A Case Study on a Security Maturity Assessment of a Business-to-Business Electronic Commerce Organization

Implementation of Security Features in Software Development Phases

Convergence of Corporate and Information Security

Security Model For Service-Oriented Architecture

Fundamental Challenges in Cybersecurity and a Philosophy of Vulnerability-Guided Hardening

The Security Dilemma: A Conceptual Analysis

Drivers and barriers for secure hardware adoption across ecosystem stakeholders

From Lemons to Peaches: Improving Security ROI through Security Chaos Engineering

Building resilience: The role of enterprise security risk management in developing a resilient organisation

The cyber security threat stops in the boardroom