ICACT20220194 Question.1
Questioner: nay.min@student.mahidol.ac.th 2022-02-15 오후 1:33:26 |
ICACT20220194 Answer.1
Answer by Auhor Annette.Chen@ttc.org.tw 2022-02-15 오후 1:33:26
Chrome  Click!! |
| You have mentioned in the presentation that your future work will practice the SSDLC on the different domains but I am not quite clear on what domain you have tested for this paper. Can you also explain how did you evaluate the results, please? |
On this paper, we did it on Iot gateway. We did evaluation on 2 parts. First, on Software Composition Analysis, we did analysis on the structure. We can see the open source and the open source license. for different license. The license is very important for commercial product. Then we use SAST tool to find the issues. For us, we get the results and check each critical and major problem one-by-one to check if the problem is real problem. |
ICACT20220194 Question.2
Questioner: tomayoon@ieee.org 2022-02-15 오후 1:22:30 |
ICACT20220194 Answer.2
Answer by Auhor Annette.Chen@ttc.org.tw 2022-02-15 오후 1:22:30
Chrome Click!! |
| First of all, thank you for the good research paper and presentation contents. I would like to know more about the research environment used in this study, and also in detail about the equipment & operating systems, development languages and software libraries you used. |
We developed our SDLC environment with OS-Linux and development language- python. We integrate some open source on the CI/CD stages. Then we integrate some Security tools to SDLC to make SSDLC. Those security will based on NDV. |
ICACT20220194 Question.3
Questioner: tomayoon@ieee.org 2022-02-15 오후 1:55:15 |
ICACT20220194 Answer.3
Answer by Auhor Annette.Chen@ttc.org.tw 2022-02-15 오후 1:55:15
Chrome Click!! |
| Will you tell us what is the major achievement of this paper, and also what is further study issue from this? Thanks in advance!! |
We co-operate with IOT-Gateway company and we found the SCA on the requirement phase is very important. A lot of risk has risk because that license problem though they are open sources.Then we did SAST on test phase, we found the risk is carried from the requirement stage. So the security on design is very important on the very begin phase. We try to do more domains and to see how can we fix the security issue during different phases. |
ICACT20220194 Question.4
Questioner: namacabale@gmail.com 2022-02-15 오후 3:47:09 |
ICACT20220194 Answer.4
Answer by Auhor Annette.Chen@ttc.org.tw 2022-02-15 오후 3:47:09
Chrome Click!! |
| Dear Author, you have a very good research. Is there an existing technology almost similar to your proposal that has been deployed in real world environment? What does it lack that your work specifically addressed? Thank you and stay safe.
|
There is a project-Black Pearl which is part of US Navy project. They provide a platform for DevSecOps. There are some project for SSDLC from CiSCO, Microsoft, and so on. I believe that are for their own business need. On this paper, I did some experiments for IoT gateway, and I plan to use it for different domain, such as Oran, Drone, and so on. Our platform also integrated with different tools, so we can use them to do more analysis.
|
ICACT20220194 Question.5
Questioner: lusongfeng@hust.edu.cn 2022-02-15 오후 6:03:26 |
ICACT20220194 Answer.5
Answer by Auhor Annette.Chen@ttc.org.tw 2022-02-15 오후 6:03:26
Chrome Click!! |
| Dear author, thank you for your presention. I want to ask you about are there any cryptography tools to enhance the security of the software development lifecycle? |
Different Phases will apply different tools, from SCA, SAST, IAST, DAST, Vulnerability,PT.
Each tools support different software forms, such as source code, image, docker. The tools we use nikto, nmap, checkmarx, coverity, ... |
ICACT20220194 Question.6
Questioner: 20180922@sungshin.ac.kr 2022-02-16 오후 3:14:43 |
ICACT20220194 Answer.6
Answer by Auhor Annette.Chen@ttc.org.tw 2022-02-16 오후 3:14:43
Chrome Click!! |
| Thank you for the good presentation. Is there any part of the SDLC process that you think security is the most important? If there is, I would appreciate it if you could let me know the reason. |
I believe requirement process is the most important part. In my experience, the requirement is not defined well, the whole project will be affected.
|
ICACT20220194 Question.7
Questioner: ycc.nttu@gmail.com 2022-02-16 오후 3:16:51 |
ICACT20220194 Answer.7
Answer by Auhor Annette.Chen@ttc.org.tw 2022-02-16 오후 3:16:51
Chrome Click!! |
| Thank you for your analysis and discussion of this Practical Security Test. Do you have any suggestions for future applications with your way? |
I will do it on "Vehicle-to-everything". This is about our personal safety. |
ICACT20220194 Question.8
Questioner: 326995871@qq.com 2022-02-20 오전 12:27:36 |
ICACT20220194 Answer.8
Answer by Auhor Annette.Chen@ttc.org.tw 2022-02-20 오전 12:27:36
Chrome Click!! |
| Have your research been applied in practice? |
yes |
