检索结果-内蒙古大学图书馆

"I just looked for the solution!"On Integrating Security-Relevant Information in Non-Security API Documentation to Support secure coding practices

引用

IEEE TRANSACTIONS ON SOFTWARE ENGINEERING 2022年第9期48卷 3467-3484页

作者： Gorski, Peter Leo Moeller, Sebastian Wiefling, Stephan Lo Iacono, Luigi H BRS Univ Appl Sci Dept Comp Sci Data & Applicat Secur Grp D-53757 St Augustin Germany TU Berlin Qual & Usabil Lab D-10623 Berlin Germany

Software developers build complex systems using plenty of third-party libraries. Documentation is key to understand and use the functionality provided via the libraries' APIs. Therefore, functionality is the main focus of contemporary API documentation, while cross-cutting concerns such as security are almost never considered at all, especially when the API itself does not provide security features. Documentations of JavaScript libraries for use in web applications, e.g., do not specify how to add or adapt a Content Security Policy (CSP) to mitigate content injection attacks like Cross-Site Scripting (XSS). This is unfortunate, as security-relevant API documentation might have an influence on secure coding practices and prevailing major vulnerabilities such as XSS. For the first time, we study the effects of integrating security-relevant information in non-security API documentation. For this purpose, we took CSP as an exemplary study object and extended the official Google Maps JavaScript API documentation with security-relevant CSP information in three distinct manners. Then, we evaluated the usage of these variations in a between-group eye-tracking lab study involving N=49 participants. Our observations suggest: (1) Developers are focused on elements with code examples. They mostly skim the documentation while searching for a quick solution to their programming task. This finding gives further evidence to results of related studies. (2) The location where CSP-related code examples are placed in non-security API documentation significantly impacts the time it takes to find this security-relevant information. In particular, the study results showed that the proximity to functional-related code examples in documentation is a decisive factor. (3) Examples significantly help to produce secure CSP solutions. (4) Developers have additional information needs that our approach cannot meet. Overall, our study contributes to a first understanding of the impact of security-r

关键词： Documentation Security Software Task analysis Internet Encoding Usability API documentation content security policies secure coding practices developer centered security usable security

来源：评论

学校读者我要写书评

暂无评论

A Knowledge Transfer Framework for secure coding practices 12

A Knowledge Transfer Framework for Secure Coding Practices

引用

12th int joint conf comp sci software engn (Jcsse)

作者： Sodanil, Maleerat Porrawatpreyakorn, Nalinpat Quirchmayr, Gerald Tjoa, A. Min King Mongkuts Univ Technol North Bangkok Fac Informat Technol Bangkok Thailand Univ Vienna Fac Comp Sci Vienna Austria Vienna Univ Technol Informat & Software Engn Grp Vienna Austria

ISBN: (纸本)9781479919666

Building a secure software product is required understandings of security principles and guidelines for the secure coding in terms of programming languages to develop safe, reliable, and secure systems in software development process. Therefore, knowledge transferring is required and influenced to the most effective secure software development project. This paper proposes a knowledge transfer framework for secure coding practices with guidance for the development of secure software product and how the framework could be applied in the telecommunication industry. A set of knowledge transfer activities is specified which aligns for secure coding. Finally, the implementation of a knowledge transfer framework for secure coding practices could mitigate at least the most common mistakes in software development processes.

关键词： secure coding practices Software Engineering Knowledge Transfer Framework Security Vulnerable

来源：评论

学校读者我要写书评

暂无评论

An Educational Intervention for Teaching secure coding practices 12th

An Educational Intervention for Teaching Secure Coding Pract...

引用

12th IFIP WG 11.8 World Conference on Information Security Education (WISE)

作者： Mdunyelwa, Vuyolwethu Futcher, Lynn van Niekerk, Johan Nelson Mandela Univ Port Elizabeth South Africa Noroff Univ Coll Kristiansand Norway

ISBN: (纸本)9783030234515;9783030234508

Cybersecurity vulnerabilities are typically addressed through the implementation of various cybersecurity controls. These controls can be operational, technical or physical in nature. The focus of this paper is on technical controls with a specific focus on securing web applications. The secure coding practices used in this research are based on OWASP. An initial investigation found that there was a general lack of adherence to these secure coding practices by third year software development students doing their capstone project at a South African University. This research therefore focused on addressing this problem by developing an educational intervention to teach secure coding practices, specifically focusing on the data access layer of web applications developed in the .NET environment. Pre-tests and post-tests were conducted in order to determine the effectiveness of the intervention. Results indicated an increase in both knowledge and behaviour regarding the identified secure coding practices after exposure to the intervention.

关键词： Educational intervention secure coding practices OWASP Web application security

来源：评论

学校读者我要写书评

暂无评论

Defending against Cross-Site Scripting Attacks

引用

COMPUTER 2012年第3期45卷 55-62页

作者： Shar, Lwin Khin Tan, Hee Beng Kuan Nanyang Technol Univ Sch Elect & Elect Engn Singapore Singapore

Researchers have proposed multiple solutions to cross-site scripting, but vulnerabilities continue to exist in many Web applications due to developers' lack of understanding of the problem and their unfamiliarity ... 详细信息

关键词： Web and internet services Browsers Databases Computers Encoding Computer hacking Network security Computer security Cross-site scripting (XSS) Code vulnerabilities Web applications secure coding practices Web security

来源：评论

学校读者我要写书评

暂无评论

Defending against Web Application Vulnerabilities

引用

COMPUTER 2012年第2期45卷 66-72页

作者： Antunes, Nuno Vieira, Marco Univ Coimbra Dept Informat Sci & Technol P-3000 Coimbra Portugal

Although no single tool or technique can guard against the host of possible attacks, a defense-in-depth approach, with overlapping protections, can help secure Web applications.

关键词： Code Vulnerabilities Cross Site Scripting Web Applications secure coding practices Vulnerability Detection Attack Detection SQL Injection

来源：评论

学校读者我要写书评

暂无评论

Embedding secure coding Instruction Into the IDE: Complementing Early and Intermediate CS Courses With ESIDE

引用

JOURNAL OF EDUCATIONAL COMPUTING RESEARCH 2018年第3期56卷 415-438页

作者： Whitney, Michael Lipford, Heather Richter Chu, Bill Thomas, Tyler Winthrop Univ Rock Hill SC 29733 USA Univ N Carolina Charlotte NC 28223 USA

Many of the software security vulnerabilities that people face today can be remediated through secure coding practices. A critical step toward the practice of secure coding is ensuring that our computing students are educated on these practices. We argue that secure coding education needs to be included across a computing curriculum. We are examining an approach that complements traditional classroom instruction by turning the student's integrated development environment into an educational resource for secure coding instruction. In this article, we report on two formative and one summative study using our tool Educational Security in the Integrated Development Environment (ESIDE) in early and intermediate computer science programming courses. Our results support the viability of this approach to increase secure programming knowledge and awareness of students and also to identify several challenges for maximizing the learning opportunities within programming courses.

关键词： secure coding practices learning environments IDE-based learning secure programming

来源：评论

学校读者我要写书评

暂无评论

An Approach to Teaching secure Programming in the .NET Environment 48th

An Approach to Teaching Secure Programming in the .NET Envir...

引用

48th Annual Conference of the Southern-African-Computer-Lecturers'-Association (SACLA)

作者： Bangani, Sifiso Futcher, Lynn van Niekerk, Johan Nelson Mandela Univ Dept IT Port Elizabeth South Africa Noroff Univ Coll Fac Comp Kristiansand Norway

ISBN: (纸本)9783030356293;9783030356286

The security aspect of software applications is considered as the important aspect that can reflect the ability of a system to prevent data exposures and loss of information. For businesses that rely on software solutions to keep operations running, a failure of a software solution can stop production, interrupt processes, and may lead to data breaches and financial losses. Many software developers are not competent in secure programming. This leads to risks that are caused by vulnerabilities in the application code of software applications. Although various techniques for writing secure code are known, these techniques are rarely fundamental components of a computing curriculum. This paper proposes the teaching of secure programming through a step-by-step approach. Our approach includes the identification of application risks and secure coding practices as they relate to each other and to basic programming concepts. We specifically aim to guide educators on how to teach secure programming in the .Net environment.

关键词： Programming education secure coding practices secure programming

来源：评论

学校读者我要写书评

暂无评论

SECURITY INTEGRATION IN AGILE METHODOLOGY

SECURITY INTEGRATION IN AGILE METHODOLOGY

引用

2024 IEEE SmartBlock4Africa, SmartBlock4Africa 2024

作者： Shokunbi, Opeyemi Uche, Obinna Akinwunmi, Damilare Akinwumi, Hannah Awodele, Oludele Ayankoya, Folasade Babcock University Dept. of Computer Science Ilishan-Remo Nigeria

ISBN: (纸本)9798350376838

This systematic review explores the integration of security practices into Agile software development. Through a comprehensive analysis of academic papers, industry reports, and case studies, the review identifies key challenges, solutions, and best practices for enhancing security within Agile methodologies. Key findings reveal the importance of incorporating security activities at all stages of Agile processes, providing a framework for achieving secure software development. The review concludes with actionable recommendations, including the early involvement of security experts, continuous integration of security practices, and fostering a security-centric culture within Agile teams. © 2024 IEEE.

关键词： Agile methodology Agile security practices Risk management secure coding practices secure software development Security integration Threat modeling Vulnerability management

来源：评论

学校读者我要写书评

暂无评论

DATA MASKING AND TOKENISATION 35

DATA MASKING AND TOKENISATION

引用

35th International DAAAM Symposium on Intelligent Manufacturing and Automation, DAAAM 2024

作者： Bosnjak, Maristela Redzepagic, Jasmin Zgrablic, Luka

This research paper examines mobile application security, focusing on data masking and tokenisation, which are essential for protecting sensitive data on Android and iOS platforms. It delves into platform-specific vulnerabilities and details techniques to safeguard data at rest and in transit. The study advocates for secure coding practices, advanced encryption, and regular security audits to enhance mobile app security. It emphasises the role of Mobile Device Management (MDM) solutions in strengthening security measures. To connect theory with practice, the paper includes real-world case studies that demonstrate the effectiveness of these security practices in various scenarios. These case studies provide actionable insights for developers, IT security practitioners, and professionals aiming to improve the development and management of secure mobile applications. © 2024 Danube Adria Association for Automation and Manufacturing, DAAAM. All rights reserved.

关键词： data masking mobile application security secure coding practices security audit

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：