TU Darmstadt / ULB / TUbiblio

Time for Addressing Software Security Issues: Prediction Models and Impacting Factors

Othmane, Lotfi Ben ; Chehrazi, Golriz ; Bodden, Eric ; Tsalovski, Petar ; Brucker, Achim (2015)
Time for Addressing Software Security Issues: Prediction Models and Impacting Factors.
Report, Bibliographie

Abstract

Finding and fixing software vulnerabilities has become a major struggle for most software-development companies. While generally without alternative, such fixing efforts are a major cost factor, which is why companies have a vital interest in focusing their secure software development activities such that they obtain an optimal return on this investment. We investigate, in this paper, quantitatively the major factors that impact the time it takes to fix a given security issue based on data collected automatically within SAP’s secure development process and we show how the issue fix time could be used to monitor the fixing process. We use three machine-learning methods and evaluate their predictive power in predicting the time to fix issues. Interestingly, the models indicate that the impact of vulnerability type has a small impact on issue fix time. The time it takes to fix an issue instead seems much more related to the component in which the potential vulnerability resides, the project related to the issue, the development groups that address the issue, and the closeness of the software release date. This indicates that the software structure, the fixing processes, and the development groups are the dominant factors that impact the time spent to address security issues. SAP can use the models to implement a continuous improvement of its secure software development process and to measure the impact of individual improvements. Other companies can use similar models and mechanisms an be a learning organization.

Item Type: Report
Erschienen: 2015
Creators: Othmane, Lotfi Ben ; Chehrazi, Golriz ; Bodden, Eric ; Tsalovski, Petar ; Brucker, Achim
Type of entry: Bibliographie
Title: Time for Addressing Software Security Issues: Prediction Models and Impacting Factors
Language: German
Date: November 2015
Place of Publication: Darmstadt
Publisher: Technische Universität
Series: Technical Report
Corresponding Links:
Abstract:

Finding and fixing software vulnerabilities has become a major struggle for most software-development companies. While generally without alternative, such fixing efforts are a major cost factor, which is why companies have a vital interest in focusing their secure software development activities such that they obtain an optimal return on this investment. We investigate, in this paper, quantitatively the major factors that impact the time it takes to fix a given security issue based on data collected automatically within SAP’s secure development process and we show how the issue fix time could be used to monitor the fixing process. We use three machine-learning methods and evaluate their predictive power in predicting the time to fix issues. Interestingly, the models indicate that the impact of vulnerability type has a small impact on issue fix time. The time it takes to fix an issue instead seems much more related to the component in which the potential vulnerability resides, the project related to the issue, the development groups that address the issue, and the closeness of the software release date. This indicates that the software structure, the fixing processes, and the development groups are the dominant factors that impact the time spent to address security issues. SAP can use the models to implement a continuous improvement of its secure software development process and to measure the impact of individual improvements. Other companies can use similar models and mechanisms an be a learning organization.

Uncontrolled Keywords: Secure Software Engineering Group, Human factors, secure software, issue fix time
Divisions: 20 Department of Computer Science
20 Department of Computer Science > Databases and Distributed Systems
LOEWE
LOEWE > LOEWE-Zentren
LOEWE > LOEWE-Zentren > CASED – Center for Advanced Security Research Darmstadt
Date Deposited: 30 Dec 2016 20:23
Last Modified: 24 Aug 2023 10:07
PPN:
Export:
Suche nach Titel in: TUfind oder in Google
Send an inquiry Send an inquiry

Options (only for editors)
Show editorial Details Show editorial Details