Towards Agile Cybersecurity Risk Management for Autonomous Software Engineering Teams

Abstract

In this study, a framework was developed, based on a literature review, to help managers incorporate cybersecurity risk management in agile development projects. The literature review used predefined codes that were developed by extending previously defined challenges in the literature—for developing secure software in agile projects—to include aspects of agile cybersecurity risk management. Five steps were identified based on the insights gained from how the reviewed literature has addressed each of the challenges: (1) risk collection; (2) risk refinement; (3) risk mitigation; (4) knowledge transfer; and (5) escalation. To assess the appropriateness of the identified steps, and to determine their inclusion or exclusion in the framework, a survey was submitted to 145 software developers using a four-point Likert scale to measure the attitudes towards each step. The resulting framework presented herein serves as a starting point to help managers and developers structure their agile projects in terms of cybersecurity risk management, supporting less overloaded agile processes, stakeholder insights on relevant risks, and increased security assurance.

A Gap Analysis of the Adoption Maturity of Certificateless Cryptography in Cooperative Intelligent Transportation Systems

“…This indicates that, in order to pick up new security technology such as CLC, even in the first stages of innovation, the prerequisite is to hire people skilled in cryptography, or develop the competence in the organization. This underpins what previous studies have noted regarding the increasingly broad expertise required for decision makers of security controls [5][6][7]. Regardless, this would naturally lead to increased costs, not only in terms of competence development, but also in technology development; an investment which has shown to not always result in a more profitable product [12], thus potentially affecting the decision phase towards a rejection.…”

“…These security controls can be "any process, policy, procedure, guideline, practice or organizational structure, which can be administrative, technical, management, or legal in nature which modify information security risk" ( [4], p. 2). Security controls are typically identified and selected as a result of a risk assessment, often requiring a broad set of skills and knowhow [5][6][7], as it aims to maximize resource allocation as well as benefit the security controls offered in assisting (rather than burdening) organizational operation and development [8]. However, adoption of new security controls often means changes to the organization's environment, which is not always perceived as useful, depending on the organization's change-readiness [9].…”

Optimizing Bug Bounty Programs for Efficient Malware-Related Vulnerability Discovery

“…Bug bounty programs not only complement existing security assessments performed by organizations but also allow for the discovery of hidden vulnerabilities, thereby contributing to improved software security ( [11]; [12]). Furthermore, they have been proposed as solutions for agile software development teams that lack the necessary baseline level of security skills and awareness, thereby offering an avenue for penetration testing and vulnerability identification [13].…”

Agile privacy in practice: Integrating CCPA and GDPR within agile frameworks in the U.S. tech scene

“…This includes identifying privacy-related user stories, defining privacy requirements for each story, and allocating time in sprints to address these requirements. By incorporating privacy into user stories and sprint planning, Agile teams can ensure that privacy is a priority from the outset of a project (Block, 2023, Salin & Lundgren, 2022. Privacy regulations are constantly evolving, and Agile teams must continuously monitor and adapt to these changes.…”