 ICACT20220036 Slide.01
[Big Slide]
[YouTube] |
Chrome  Click!! |
 |
Hi everyone. Our topic is “Trustworthy Software Development – practical view of security processes through MVP methodology”. |
| ICACT20220036 Slide.02
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
What is project phase? It contains Initiate, definition, execution, monitor, and close. |
| ICACT20220036 Slide.03
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
What is IS0/IEC/IEEE 15288 processes? It contains 30 processes. We can separate as agreement, Organization project-enabling processes, technical management, and Technical. |
| ICACT20220036 Slide.04
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Here we combine the SSDLC activities and project phases together. |
| ICACT20220036 Slide.05
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
DevSecOps architecture must have the capability to meet the operational software requirements, including: business systems, command and control systems, embedded and weapon systems, intelligence analysis systems, autonomous systems, and assisted human operations. |
| ICACT20220036 Slide.06
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
We are talking about the relative work and our contribution. |
| ICACT20220036 Slide.07
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Due to the innovation of 5G architecture, open source is widely used under the software-defined everything architecture, software security is even more important. No matter on the standard organization or brand companies, they proposal some security standards and methodologies to make sure the product is secure. |
| ICACT20220036 Slide.08
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
A trustworthiness framework implementation trustworthiness aspects ｗas proposed to makes software more reliable and trustworthy for users and allows enterprises and developers to control and test the trustworthiness of production. After that, the analysis of software security is provided. This platform will provide the guidance for industries easier to use and apply to their product. |
| ICACT20220036 Slide.09
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Evaluation |
| ICACT20220036 Slide.10
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
On 5G era, billions of devices are connected to internet. Trustworthiness becomes more and more important for users and developers. A trustworthiness framework with software development process will be proposed. The platform will start with the minimal viable product (MVP) which is a platform that determines if a project is compatible with the required software development, ensuring reliability, trustworthiness, and security fundamentals. The framework will examine the source code and binary code during different development phases. |
| ICACT20220036 Slide.11
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
On the requirements and design stages, agreement process, organizational project-enabling process, technical management, and part of technical will be applied.
Those processes will include several activities which are meeting, documents relative to the meeting, and software composition analysis (SCA).
The meeting activities are for acquisition, supply, portfolio management, life cycle model management, infrastructure management, human resource management, Quality Management, knowledge management, decision management, risk management, configuration management, information management, project planning, project assessment and control, measurement, quality assurance, business or mission analysis, stakeholder needs and requirements definition, system requirements definition, architecture definition, design definition, and system analysis. The SCA is performed to evaluate security, license compliance, and code quality, especially on the open source licenses. |
| ICACT20220036 Slide.12
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Secondly, on the coding & testing stage which is execute phase according to PMBOK, implementation process will be used. The activities have meeting, documentation, software (code) composition analysis (SCA), static application (code) security testing (SAST), and interactive application (binary) security testing (IAST). SAST is a white-box testing tool and is used to scan an application’s source, binary, or byte code. It identifies the root cause of vulnerabilities and helps remediate the underlying security flaws and is a frequently used on application security. SAST analyzes an application from the “inside out” and do not reed a running system to perform a scan. IAST analyzes code for security vulnerabilities while the application is run by testing, or any activity “interacting” with the application functionality and reports vulnerabilities in real-time, which means it does not add any extra time to your CI/CD pipeline. |
| ICACT20220036 Slide.13
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Thirdly, on the build and testing stage, integration, verification, transition, and validation processes will be applied. The activities have IAST, SAST, SCA, Dynamic Application (binary) Security Testing (DAST), Application (binary) Vulnerability Scan (AVS), IoT Vulnerability Scan, and Penetration Test. DAST is a black box testing without knowledge of the application’s internal interactions or designs at the system level, and with no access or visibility into the source program. An application’s responses to simulations to determine whether the application is vulnerable and could be susceptible to a real malicious attack. A penetration test is an attempt to evaluate the security of an IT infrastructure by trying to exploit vulnerabilities. |
| ICACT20220036 Slide.14
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Fourthly, the release stage which is part of close phase. In this stage will build the knowledge by lesson learn and make the root cause analysis report which will be knowledge process and also be an assessment of the organization. |
| ICACT20220036 Slide.15
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Finally, Ops stage contains operation/maintenance and disposal. There are some operation/maintenance and disposal relative security documents should be defined. For maintenance, the reliable of the software source and update is very important, continue on relative security testing will be executed to make sure the trustworthiness. |
| ICACT20220036 Slide.16
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
To better understand the platform, we use a software product without any security requirements and design to do testing. Compared with a well-design software, there are not only vulnerability issues but also bugs, code smells, and duplication. Using this platform, there are a couple of processes to defect those issue before it go to product stage. |
| ICACT20220036 Slide.17
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Conclusion and Future Work |
| ICACT20220036 Slide.18
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Our conclusion are: A large number of open source software is widely used in software development, it causes more probabilities to have vulnerabilities exist and difficult to detect.
It is not secure enough if only follow the individual industry certification standards. For example: you might follow ETSI EN 303 645 and pass the testing. However, it might not be trustworthy because that the library you employed might not be safe. Nowadays, the software structure become more complex, so the waterfall could not fit the rapid need. So the NIST recommends change the development phases to processes. The users can define which processes should be employed to the development life cycle by the users’ need. However, this makes the design and development of the platform more difficulty. In addition to, the devices rapid needed because of the Massive Machine Type Communications (mMTC) characteristics of 5G. The operation system and the language are diverse. It’s difficult to defect the vulnerabilities. |
| ICACT20220036 Slide.19
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
The future work, we will work on the multiple development environments and work with different industries to find a good guidance. |
| ICACT20220036 Slide.20
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Thank you! |
