Abstract
Security risk assessment is often a heavy manual process, making it expensive to perform. DevOps, that aims at improving software quality and speed of delivery, as well as DevSecOps that augments DevOps with the automation of security activities, provide tools and procedures to automate the risk assessment. We propose a solution to integrate risk assessment with DevSecOps activities and processes in order to make the risk assessment more continuous and automated. The solution is illustrated on a use case where the firewall of a robot vehicles is updated while risk assessment is done in an iterative manner. This approach aims at facilitating assessment (and certification such as EUCC) processes.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
Notes
- 1.
- 2.
- 3.
- 4.
- 5.
- 6.
- 7.
- 8.
In this paper we use the following notation. Capital letters (e.g., TF) denote sets and lowercase letters denote single values (e.g., oc). The same lowercase letters as the set name with indexes denote specific element of this set (e.g., \(tf_i\)). Bold capital letters denote a set of variables which is more convenient to represent as a matrix (e.g., \(\boldsymbol{AM}\)), and their elements require two indexes (e.g., \(am_{i,j}\)). n always denotes size of a set.
- 9.
In fact, for a control m only a few \(sc_{m,l}\ne 0\), i.e., only a limited amount of security features contributes to a security control. Moreover, in most cases, for a security feature l, there is only one \(sc_{m,l}\ne 0\).
References
Dupont, S., et al.: Incremental common criteria certification processes using devsecops practices. p. 12 (2021). https://ieeexplore.ieee.org/abstract/document/9583720
ISO. ISO/IEC 27000 Family - Information Security Management Systems. https://www.iso.org/isoiec-27001-information-security.html (2013)
Boehm, B.: Software risk management: principles and practices. IEEE Softw. 8(1), 32–41 (1991)
Verdon, D., McGraw, G.: Risk analysis in software design. IEEE Secur. Priv. 2(4), 79–84 (2004)
Baca, D., Petersen, K.: Countermeasure graphs for software security risk assessment. J. Syst. Softw. 86(9), 2411–2428 (2013)
Sahinoglu, M.: An input-output measurable design for the security meter model to quantify and manage software security risk. IEEE Trans. Instrum. Meas. 57(6), 1251–1260 (2008)
ISO/IEC. Common Criteria for Information Technology Security Evaluation, version 3.1 revision 5 ed
Edwards, D.: What is devops. Retrieved 3, 2014 (2010)
Myrbakken, H., Colomo-Palacios, R.: DevSecOps: a multivocal literature review. In: Mas, A., Mesquida, A., O’Connor, R.V., Rout, T., Dorling, A. (eds.) SPICE 2017. CCIS, vol. 770, pp. 17–29. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-67383-7_2
Rajapakse, R.N., Zahedi, M., Babar, M.A., Shen, H.: Challenges and solutions when adopting devsecops: a systematic review. Inf. Softw. Technol. 141, 106700 (2022)
Díaz, J., Pérez, J.E., Lopez-Peña, M.A., Mena, G.A., Yagüe, A.: Self-service cybersecurity monitoring as enabler for devsecops. IEEE Access 7, 100283–100295 (2019)
Hsu, T.H.-C.: Hands-On Security in DevOps: Ensure Continuous Security, Deployment, and Delivery with DevSecOps. Packt Publishing Ltd, Birmingham (2018)
Mohan, V., Othmane, L.: Secdevops: Is it a Marketing Buzzword. Department of Computer Science, Technische Universität Darmstadt, Darmstadt (2016)
ISO/IEC. ISO/IEC 27005:2008 Information technology - Security techniques - Information security risk management (2008)
NIST. Risk management framework for information systems and organizations. a system life cycle approach for security and privacy. NIST, Tech. Rep., (2018). https://csrc.nist.gov/projects/risk-management/about-rmf on 09/05/2022
Sadiq, M., Rahmani, M.K.I., Ahmad, M.W., Jung, S.: Software risk assessment and evaluation process (sraep) using model based approach. In: International Conference on Networking and Information Technology 2010, 171–177 (2010)
Khan, M.A., Khan, S., Sadiq, M.: Systematic review of software risk assessment and estimation models. Int. J. Eng. Adv. Technol. 1(4) (2012)
Zhang, Y., Jiang, S., Cui, Y., Zhang, B., Xia, H.: A qualitative and quantitative risk assessment method in software security. In: 2010 3rd International Conference on Advanced Computer Theory and Engineering(ICACTE). vol. 1, pp. V1–534-V1-539 (2010)
Das, R., Sarkani, S., Mazzuchi, T.A.: Software selection based on quantitative security risk assessment. In: 2012 IEEE 14th International Symposium on High-Assurance Systems Engineering, pp. 171–172 (2012)
Mkpong-Ruffin, I., Umphress, D., Hamilton, J., Gilbert, J.: Quantitative software security risk assessment model. In: Proceedings of the 2007 ACM Workshop on Quality of Protection, ser. QoP 2007. New York, USA: Association for Computing Machinery, pp. 31–33 (2007)
Kumar, R., Goyal, R.: Modeling continuous security: a conceptual model for automated DevSecOps using open-source software over cloud (ADOC). Comput. Secu. 97, 101967 (2020)
Acknowledgment
This paper was supported in part by European Union’s Horizon 2020 research and innovation programme under Grant Agreement No. 830892, project “Strategic programs for advanced research and technology in Europe” (SPARTA).
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2023 The Author(s), under exclusive license to Springer Nature Switzerland AG
About this paper
Cite this paper
Dupont, S. et al. (2023). Product Incremental Security Risk Assessment Using DevSecOps Practices. In: Katsikas, S., et al. Computer Security. ESORICS 2022 International Workshops. ESORICS 2022. Lecture Notes in Computer Science, vol 13785. Springer, Cham. https://doi.org/10.1007/978-3-031-25460-4_38
Download citation
DOI: https://doi.org/10.1007/978-3-031-25460-4_38
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-031-25459-8
Online ISBN: 978-3-031-25460-4
eBook Packages: Computer ScienceComputer Science (R0)