Campus Units

Electrical and Computer Engineering

Document Type

Conference Proceeding

Conference

2019 IEEE 43rd Annual Computer Software and Applications Conference (COMPSAC)

Publication Version

Accepted Manuscript

Link to Published Version

https://doi.org/10.1109/COMPSAC.2019.10268

Publication Date

7-9-2019

Journal or Book Title

2019 IEEE 43rd Annual Computer Software and Applications Conference (COMPSAC)

First Page

569

Last Page

574

DOI

10.1109/COMPSAC.2019.10268

Conference Title

2019 IEEE 43rd Annual Computer Software and Applications Conference (COMPSAC)

Conference Date

July 15-19, 2019

City

Milwaukee, WI

Abstract

Companies develop their software in versions and iterations. Ensuring the security of each additional version using code review is costly and time consuming. This paper investigates automated tracing of the impacts of code changes on the security of a given software. To this end, we use call graphs to model the software code, and security assurance cases to model the security requirements of the software. Then we relate assurance case elements to code through the entry point methods of the software, creating a map of monitored security functions. This mapping allows to evaluate the security requirements that are affected by code changes. The approach is implemented in a set of tools and evaluated using three open-source ERP/E-commerce software applications. The limited evaluation showed that the approach is effective in identifying the impacts of code changes on the security of the software. The approach promises to considerably reduce the security assessment time of the subsequent releases and iterations of software, keeping the initial security state throughout the software lifetime.

Comments

This is a manuscript of a proceeding published as Abdelkhalek, Moataz, Ameerah-Muhsina Jamil, and Lotfi ben Othmane. "Identification of the Impacts of Code Changes on the Security of Software." 2019 IEEE 43rd Annual Computer Software and Applications Conference (COMPSAC): 569-574. DOI: 10.1109/COMPSAC.2019.10268. Posted with permission.

Rights

© 2019 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.

Copyright Owner

IEEE

Language

en

File Format

application/pdf

Published Version

Share

Article Location

 
COinS