Bridging the Gap between Software Development and Information Security

Authors:
Kenneth R. van Wyk;Gary McGraw
Affiliations:
Cigital and KRVW Associates;Cigital
Venue:
IEEE Security and Privacy
Year:
2005

Citing 3
Cited 5

The Shellcoder's Handbook: Discovering and Exploiting Security Holes

The Shellcoder's Handbook: Discovering and Exploiting Security Holes
Exploiting Software: How to Break Code

Exploiting Software: How to Break Code
Forensic Discovery

Forensic Discovery

Secure Software Engineering: Learning from the Past to Address Future Challenges

Information Security Journal: A Global Perspective
An empirical evaluation of information security awareness levels in designing secure business processes

Proceedings of the 4th International Conference on Design Science Research in Information Systems and Technology
Harnessing web-based application similarities to aid in regression testing

ISSRE'09 Proceedings of the 20th IEEE international conference on software reliability engineering
Survey and analysis on Security Requirements Engineering

Computers and Electrical Engineering
Not Ready for Prime Time: A Survey on Security in Model Driven Development

International Journal of Secure Software Engineering

Quantified Score

Hi-index	0.00

Visualization

Abstract

Traditionally, software development efforts in large corporations have been about as far removed from information security as they were from human resources or any other business function. The disconnect between security and development has ultimately produced software development efforts that lack any sort of contemporary understanding of technical security risks. Today's complex and highly connected computing environments trigger myriad security concerns, so by blowing off the idea of security entirely, software builders virtually guarantee that their creations will have way too many security weaknesses that could--and should--have been avoided. This article presents some recommendations for solving this problem.