Welcome to the InfoSci Platform
Reference Hub14
Risk Centric Activities in Secure Software Development in Public Organisations

Risk Centric Activities in Secure Software Development in Public Organisations

Inger Anne Tøndel, Martin Gilje Jaatun, Daniela Soares Cruzes, Nils Brede Moe
Copyright: © 2017 |Volume: 8 |Issue: 4 |Pages: 30
ISSN: 1947-3036|EISSN: 1947-3044|EISBN13: 9781522513889|DOI: 10.4018/IJSSE.2017100101
Cite Article Cite Article

MLA

Tøndel, Inger Anne, et al. "Risk Centric Activities in Secure Software Development in Public Organisations." IJSSE vol.8, no.4 2017: pp.1-30. http://doi.org/10.4018/IJSSE.2017100101

APA

Tøndel, I. A., Jaatun, M. G., Cruzes, D. S., & Moe, N. B. (2017). Risk Centric Activities in Secure Software Development in Public Organisations. International Journal of Secure Software Engineering (IJSSE), 8(4), 1-30. http://doi.org/10.4018/IJSSE.2017100101

Chicago

Tøndel, Inger Anne, et al. "Risk Centric Activities in Secure Software Development in Public Organisations," International Journal of Secure Software Engineering (IJSSE) 8, no.4: 1-30. http://doi.org/10.4018/IJSSE.2017100101

Export Reference

Mendeley
Favorite Full-Issue Download

Abstract

When working with software security in a risk-centric way, development projects become equipped to make decisions on how much security to include and what type of security pays off. This article presents the results of a study made among 23 public organisations, mapping their risk-centric activities and practices, and challenges for implementing them. The authors found that their software security practices were not based on an assessment of software security risks, but rather driven by compliance. Additionally, their practices could in many cases be characterised as arbitrary, late and error driven, with limited follow up on any security issues throughout their software development projects. Based on the results of the study, the authors identified the need for improvements in three main areas: responsibilities and stakeholder cooperation; risk perception and competence; and, practical ways of doing risk analysis in agile projects.

Request Access

You do not own this content. Please login to recommend this title to your institution's librarian or purchase it from the IGI Global bookstore.