Introducing a Novel Security-Enhanced Agile Software Development Process

Abstract

In this paper, a novel security-enhanced agile software development process, SEAP, is introduced. It has been designed, tested, and implemented at Ericsson AB, specifically in the development of a mobile money transfer system. Two important features of SEAP are 1) that it includes additional security competences, and 2) that it includes the continuous conduction of an integrated risk analysis for identifying potential threats. As a general finding of implementing SEAP in software development, the developers solve a large proportion of the risks in a timely, yet cost-efficient manner. The default agile software development process at Ericsson AB, i.e. where SEAP was not included, required significantly more employee hours spent for every risk identified compared to when integrating SEAP. The default development process left 50.0% of the risks unattended in the software version that was released, while the application of SEAP reduced that figure to 22.5%. Furthermore, SEAP increased the proportion of risks that were corrected from 12.5% to 67.9%, a more than five times increment.

Malware behavior

“…It is also worth to notice that all of the classes target the user's privacy. Some harmful effects attributed to spyware are presented by Boldt et al [23]. The authors mention four main categories of risks posed by spyware: consumption of system capacity (processing) and consumption of bandwidth can cause availability problems; Security issues and privacy issues, such as user's information (credentials, e-mail addresses) leakage through covert communications violate the principle of confidentiality.…”

“…Saroiu et al [128] defines (sometimes overlapping) subclasses to spyware that are based on their expected behavior. Boldt et al [23] classifies spyware according to the risk they pose to the security principles of availability and confidentiality.…”