Identification of Risk Factors Using ANFIS-Based Security Risk Assessment Model for SDLC Phases

Abstract

In the field of software development, the efficient prioritizing of software risks was essential and play significant roles. However, finding a viable solution to this issue is a difficult challenge. The software developers have to adhere strictly to risk management practice because each phase of SDLC is faced with its individual type of risk rather than considering it as a general risk. Therefore, this study proposes an adaptive neuro-fuzzy inference system (ANFIS) for selection of appropriate risk factors in each stages of software development process. Existing studies viewed the SDLC’s Security risk assessment (SRA) as a single integrated process that did not offer a thorough SRA at each stage of the SDLC process, which resulted in unsecure software development. Hence, this study identify and validate the risk factors needed for assessing security risk at each phase of SDLC. For each phase, an SRA model based on an ANFIS was suggested, using the identified risk factors as inputs. For the logical representation of the fuzzification as an input and output variables of the SRA risk factors for the ANFIS-based model employing the triangular membership functions. The proposed model utilized two triangular membership functions to represent each risk factor’s label, while four membership functions were used to represent the labels of the target SRA value. Software developers chose the SRA risk factors that were pertinent in their situation from the proposed taxonomy for each level of the SDLC process as revealed by the results. As revealed from the study’s findings, knowledge of the identified risk factors may be valuable for evaluating the security risk throughout the SDLC process.

A Systematic Review of Risk Management Tools and Techniques in Software Projects

“…Identify Risk [22] Root Cause of the Problems [23] Learning Cycle [24] Periodic Risk Reporting [22] Periodic risk status reporting…”

“…To ensure a seamless integration within Agile methodologies, it is crucial to seamlessly incorporate risk identification efforts. The output of this process is a Risk Register, overseen by the Project Manager or Scrum Master, wherein every team member can contribute by utilizing root cause analysis to identify potential risks [22]. Moreover, the team consistently reports risks during daily scrum meetings, ensuring that the Risk Register remains up-to-date and reflects the evolving project landscape [24].…”

“…Risks are assessed thoroughly and given a score based on the likelihood and potential impact, ranging from low, medium to high levels. Using this information, a risk matrix was created to provide a visual representation of the risks, considering their probability and severity [21], [22], [24]. In an agile context, if a risk is deemed urgent and impacts the current Sprint, immediate assessment and response via ad hoc meetings is required.…”

“…In an agile context, if a risk is deemed urgent and impacts the current Sprint, immediate assessment and response via ad hoc meetings is required. Otherwise, the risk can be postponed until the next official Risk Management meeting, which will be held at the start of the Sprint [22].…”

Management System Project for Textile Company using Risk Management Analysis

“…With the protection of IT systems and the ability of organizations to achieve missions. Risk management can also lead to decisions that make sense in all aspects of daily life (Jimoh et al, 2022;Manun-Og et al, 2022).…”