The application of agile methods has become increasingly popular that now it is also used in critical system development. Because of this, it is essential to consider the security aspects during agile development. Despite security being knowledge-intensive, developers and product owners in agile projects still have low security knowledge. To overcome this problem, people require more access to easily processable and up-to-date security information, which should be provided on-time and without excessive e ort. In this paper, we propose a framework for security data extraction, processing and application. The framework consists of two main components: a security data collection and analysis component as well as a security knowledge generation component. However, the development and process integration of such a framework poses many challenges that are discussed in this paper.
Agile software development has become increasingly popular to the point that
now it is even used for critical system development [
In traditional projects this problem is often addressed by an explicit security o cer who is responsible for security issues and transferring security knowledge to developers. However, in an agile development process, where iterations are short and changes are performed continuously, this is often not the case.
When it comes to an agile context, people require easily processable and
upto-date security information, meaning it should be provided on-time and
without excessive e ort. To support this, data can be extracted and processed from
both public and private information sources, such as vulnerability databases,
forums, blogs, conferences on security, or emails. Afterwards, the security measures
should be based on the extracted data. Activities in this direction are currently
performed in the cyber threat intelligence sharing [
Intelligence is also one of the four domains of the Building Security In
Maturity Model (BSIMM) [
In order to empower agile teams with security knowledge, we want to present a framework for security data extraction, processing and application, and related research challenges.
Consequently, the remainder of this challenge paper is structured as follows: Section 2 sketches a framework for security data extraction, processing and application. Section 3 discusses research challenges on the basis of the de ned framework. Finally, Section 4 concludes the paper. 2
Framework for security data extraction, processing and application In this section, we give an overview of a framework for security data extraction, processing and application. Figure 1 provides an overview of the proposed framework.
The proposed framework consists of two major components, i.e., a Security Data Collection and Analysis Component and a Security Knowledge Generation Component. In the following, we explain these two components in more detail.
The Security Data Collection and Analysis Component is responsible for the following: data extraction from various data sources, quality assessment of data and data merging in order to provide the data in a processable form.
Currently, there are several available online sources, which store security
related information. These include the Common Vulnerabilities and Exposures
(CVE) [
Once the data is extracted and available, it must be formatted, the quality assessed and then merged. This is done through the Security Data Collection and Analysis Component. Because of the type of information being handled and the fact that there are di erent data elds to deal with, this is a highly complex task. For instance, the CVE database contains information about vulnerabilities and exposures, while the MISP database consists of malware and threat-related data, and it is expected to have multiple mismatches. In order to overcome such di erences, a general format is proposed, which includes information such as name, type, year, target platform, description and reference.
The Security Knowledge Generation Component processes the extracted security information in order to provide it for di erent roles and various purposes in the agile development process. For instance, a developer can be provided with a security dashboard or concrete guidelines on how code can be secured or security properties can be tested. As for the product owner, they can receive guidelines on security requirements. Finally, when developing a safety critical system, a developer who is responsible for the system architecture can be provided with generated attack models that can be integrated with available system models to perform an integrated safety-security analysis.
An additional input for the Security Knowledge Generation Component is the event data, which is gathered by scanning local networks and proprietary software applications. Because of the fact that there are available software solutions that provide this service, it is unnecessary to reinvent the wheel. It is su cient to apply Nessus or other similar applications.
Another signi cant aspect is keeping track of private data sources such as user pro les or email logs. It is important to keep track of users that have access to a project. This includes their access level information and action logs. Based on the available user data, it is possible to apply the user anomaly detection (UAD) algorithms and search for a deviation among di erent users. If actively monitored and regularly updated, it will help detect possible intrusions via masquerade attacks, which can signi cantly impact security. In addition, the monitoring of certain private user sources can lead to the enrichment of collected security related information. For instance, custom email scanners could search for a speci c set of keywords that are known to potentially impact security. Once they detect a possible security issue, the Security Knowledge Generation Component will generate alerts and reports for the security o cer. By doing so, it is possible to provide an active guidance to the agile team members and enforce the required security mechanisms.
All the security related information that were collected using the Security Data Collection and Analysis Component as well as the independent modules are used by the Security Knowledge Generation Component, wherein the data is correlated in order to produce a valuable input for a developer or product owner. The component stores all the generated security information into the knowledge database. This data store is also used to generate additional information by correlating all the resources that are available within. Furthermore, when necessary, a team member can provide additional input for the Security Knowledge Generation Component. The output of the framework includes reports, alerts and charts. Based on the result that is provided by this component, the alerts of di erent intensities will be generated. For example, if there was an indication that there is a vulnerability that could cause minor damage to a system, such as gaining access to the part of a system where valuable information cannot be retrieved, an alert of low intensity would be generated. On the other hand, if the Security Knowledge Generation Component concludes that the attacker could gain access to valuable data, such as the account information, an alert of high intensity would be created. The framework provides support for 10 types of alert intensities, thereby giving the agile software development team the ability to prioritize security issues and resolve them e ectively. 3
This section outlines relevant challenges in empowering agile teams with security knowledge based on public and private information sources.
In order to develop a bene cial security knowledge database, it is necessary to extract high-quality security information. There are various sources that are available as online data stores. However, the identi cation of such sources is a highly challenging task. In fact, combining too many sources may result in an overpopulated database, making it extremely di cult to devise security knowledge due to the diversity of data. On the other hand, the consolidation of a small number of sources could result in an inability to devise information that are more valuable than the ones already present in the online security data stores. Thus, to avoid these related issues that may arise, the most appropriate approach is to combine small number of sources and then gradually increase the number when required. Overall, only a small amount (about 5%) of the information found in general sources is somewhat relevant.
Due to the diversity of available sources, it becomes increasingly di cult to prioritize sources and to assess their validity. For instance, a certain security database may store data that is considered to be more valuable than another database. Therefore, it is necessary to develop a metric that will determine the suitability of each source.
Another challenge that needs to be addressed is the extraction of data. Considering that most of the sources keep data in an unstructured and semistructured format, it will be necessary to create custom adapters for each speci c source.
Once the data is collected, it must be merged, thereby bringing a whole new group of challenges, such as devising a general format, managing inconsistencies, assessing information that are relative to each other and selecting information based on stakeholder requirements.
In terms of the general format for security related information, it is possible
to apply the Structured Threat Information eXpression (STIX) [
It might be very di cult to fully automate the proposed framework. While it
is possible to automate the extraction and merging of security related data, the
automation of the Security Knowledge Generation Component will be a
challenging task. Therefore, the solution is expected to be semi-automated and to
provide recommendations for speci c roles such as developers. This will add the
support for speci c tasks such as the de nition of guidelines for secure coding.
The key prerequisites to ensure continuous security [
In order to fully utilize generated security artifacts, it is possible to use them for attack model generation, which would provide an additional input for a security o cer. Generated attack models will surely improve the process of penetration testing and might even reduce the tendency of hiring external penetration testers, which is very common in the agile software development life-cycle. However, the development and generation of attack models is a formidable task. It requires advanced knowledge in the area of modeling and software security. In addition, it is exceedingly di cult to generate zero-day attacks because the security data that describes such attacks is not available. Nonetheless, by correlating multiple generated security artifacts, it might be possible to address this issue.
Finally, the last challenge is the integration of the proposed framework with the agile software development process. Since the focus of agile development is on early and continuous delivery, it might be challenging to integrate security related artifacts with the current artifacts. In addition, another obstacle is the lack of general security knowledge of agile teams. Therefore, it is necessary to provide advantageous information at the proper stage of agile software development life cycle. 4
This paper presented a framework for security data extraction, processing and application as well as related research challenges. The framework consists of a security data collection and analysis component as well as a security knowledge generation component. In the future, we will be investigating the stated challenges in the context of agile system development projects.