Systematic Review of Web Application Security Vulnerabilities Detection Methods

In recent years, web security has been viewed in the context of securing the web application layer from attacks by unauthorized users. The vulnerabilities existing in the web application layer have been attributed either to using an inappropriate software development model to guide the development process, or the use of a software development model that does not consider security as a key factor. Therefore, this systematic literature review is conducted to investigate the various security vulnerabilities used to secure the web application layer, the security approaches or techniques used in the process, the stages in the software development in which the approaches or techniques are emphasized, and the tools and mechanisms used to detect vulnerabilities. The study extracted 519 publications from respectable scientific sources, i.e. the IEEE Computer Society, ACM Digital Library, Science Direct, Springer Link. After detailed review process, only 56 key primary studies were considered for this review based on defined inclusion and exclusion criteria. From the review, it appears that no one software is referred to as a standard or preferred software product for web application development. In our SLR, we have performed a deep analysis on web application security vulnerabilities detection methods which help us to identify the scope of SLR for comprehensively investigation in the future research. Further in this SLR considering OWASP Top 10 web application vulnerabilities discovered in 2012, we will attempt to categories the accessible vulnerabilities. OWASP is major source to construct and validate web security processes and standards.

Design of Secure and Traceable Requirement Engineering Process for Security-Sensitive Projects

With continuous evolution in software industry, security is becoming very important in software projects. However, in many development methodologies, security is thought to be added in the project at later stages of the development lifecycle. There are also many proposed methodologies where the security measures are considered at requirement engineering stage of the development lifecycle, but many of them still do not seem adequate for applicability due to the reason that these approaches do not provide sufficient support for mapping the security requirements to the later stages of development. So, we are in need of a software requirement engineering approach, which is not only helpful in security requirement specification at requirement engineering stage but also provides support for using the specified security requirements at later stages of development. To meet this requirement, we introduce a new method Secure and Traceable Requirement Engineering Process (STREP). This method also helps the non-security-expert requirement engineers to specify requirements in such a way that the specified requirements can be used to derive security related test cases. STREP method not only deals with security issues of the system at requirement engineering stage, but also makes the security requirements more traceable to be used at later stages of development lifecycle, and as a result, secure systems are produced that are also usable as the customer wishes.

融入安全的软件开发方法SDL的研究

将SDL(Security Development Lifecycle)的开发过程的13个活动划分成了5个过程,并对5个过程中的各个活动作了详细描述,同时对每个过程的安全性作了分析。通过与传统的开发模式的对比,体现出SDL在软件开发方面更高的安全性,最后引入了微软在实践中成功应用SDL的案例来说明SDL较高的实际应用价值。

新环境下的信息系统安全开发与测试

随着信息化技术的不断发展,现有的信息系统在架构和用户体验上得到不断提升,软件开发的模式也通过敏捷,SaaS等方式得到不断的发展。但与此同时伴随着用户量的增长和用户对信息的敏感,安全问题长期困扰各类软件和互联网公司,软件的安全开发和测试不得不成为的信息系统在新环境下所面临的考验和待解决的关键问题之一。从分析新环境下信息系统研发安全需求入手,着重讨论了在软件生命周期中如何利用微软SDL来进行安全开发,并结合作者提出的安全测试方法来有效提高信息系统的安全性和解决敏感信息泄露等问题。

电信运营商应用软件安全开发生命周期管理

电信运营商目前纷纷转型搞全业务经营,日益丰富的业务需求带来了种类繁多的第三方应用软件。所以,在传统网络和系统安全的基础上,运营商们面临着定制化应用软件安全的新挑战。如何能够解决应用软件漏洞和针对漏洞发起的攻击,正逐渐成为运营商安全工作的新重点。电信运营商可以吸取软件业流行的安全开发生命周期理念,结合自身特点,研究并建立运营商自身的应用软件安全开发生命周期管理。

中小银行信息系统开发生命周期安全保障框架

通过研究微软安全开发生命周期SDL(Security Development Lifecycle)和《GB 20274信息系统安全保障评估框架》,结合江南农村商业银行信息系统建设的实践,提出适合国内中小银行信息系统开发的全生命周期安全保障框架。该框架将软件安全保障集成到信息系统开发生命周期的五个阶段中,详细阐述每个阶段要进行的安全控制措施,确保系统开发的安全性和可靠性。

AI系统的安全测评和防御加固方案

深度学习模型在很多人工智能任务上已取得出色表现,但精心设计的对抗样本却能欺骗训练有素的模型,诱导模型作出错误判断。对抗攻击的成功使得AI系统的可用性遭受质疑。为了提升AI系统安全性和鲁棒性,文章遵循安全开发流程,提出针对AI系统的安全测评和防御加固方案。该方案通过精准检测和拦截对抗攻击、科学评估模型鲁棒性、实时监控新型对抗攻击等措施,提升系统抵御对抗攻击的能力,帮助开发人员构建更安全的AI系统。

从软件安全开发生命周期实践的角度保障软件供应链安全

软件供应链安全覆盖软件的开发生命周期和生存周期,且与软件开发过程中的人员、工具、环境等因素密切相关,因而通过不同途径和不同方式能使得软件系统自带安全缺陷,并最终被恶意人员利用形成网络安全事件。文章基于行业主流的软件安全开发生命周期(S-SDLC)流程方法,从软件开发单位自身的安全开发管理、安全开发技术、供应商管理等方面,提出了软件开发过程中保障软件供应链安全的体系化方法,为软件开发过程中尽可能地避免和消除软件安全缺陷、保障软件供应链安全奠定重要基础。

面向业务:信息安全保障业务发展新趋势

如今信息安全在信息社会扮演极为重要的角色,直接关系到政府运作、企业经营和人们的日常生活,信息安全服务也已成为信息安全保障体系的重要内容。然而国内信息安全服务行业却存在很多问题,管理者的信息安全意识不足,安全服务以事件应急响应为主,忽视为客户提供主动、系统的面向业务的服务。针对这一现状,本文提出了基于业务的信息安全服务体系(Business-based Information Security Service System,BISSS),利用企业架构(Enterprise Architecture,EA)对机构及其信息系统进行分析,以信息系统的业务属性为出发点和依据,为客户提供覆盖整个信息系统生命周期的安全服务。

浅谈网络安全体系下的软件安全开发人才培养

软件安全开发是近年来我国网信行业积极实践的网络安全保障措施,旨在软件系统开发过程中降低安全漏洞的存在。然而,软件安全开发人才匮乏是当前实践面临的关键问题。文章依据行业有关软件安全开发人员岗位和技能的典型要求,介绍在当前网络安全体系下培养软件安全开发人才的关键思路和核心内容,最后说明在软件安全开发人才培养方面获得的初步成效。