Fraunhofer-Gesellschaft

Publica

Hier finden Sie wissenschaftliche Publikationen aus den Fraunhofer-Instituten.

First-time Security Audits As a Turning Point?: Challenges for Security Practices in an Industry Software Development Team

 
: Poller, Andreas; Kocksch, Laura; Kinder-Kurlanda, Katharina; Anhand Epp, Felix

:

Kaye, J.:
CHI EA '16, Proceedings of the 2016 CHI Conference. Extended Abstracts on Human Factors in Computing Systems
New York: ACM, 2016
ISBN: 978-1-4503-4082-3
pp.1288-1294
Conference on Human Factors in Computing Systems (CHI) <34, 2016, San Jose/Calif.>
English
Conference Paper
Fraunhofer SIT ()

Abstract
Software development is often accompanied by security audits such as penetration tests, usually performed on behalf of the software vendor. In penetration tests security experts identify entry points for attacks in a software product. Many development teams undergo such audits for the first time if their product is attacked or faces new security concerns. The audits often serve as an eye-opener for development teams: they realize that security requires much more attention. However, there is a lack of clarity with regard to what lasting benefits developers can reap from penetration tests. We report from a one-year study of a penetration test run at a major software vendor, and describe how a software development team managed to incorporate the test findings. Results suggest that penetration tests improve developers' security awareness, but that long-lasting enhancements of development practices are hampered by a lack of dedicated security stakeholders and if security is not properly reflected in the communicative and collaborative structures of the organization.

: http://publica.fraunhofer.de/documents/N-414839.html