How Dataflow Diagrams Impact Software Security Analysis: an Empirical Experiment
Fuente:
arXiv
Salvato in:
| Autori principali: | , , , , , |
|---|---|
| Natura: | Preprint |
| Pubblicazione: |
2024
|
| Soggetti: | |
| Accesso online: | |
| Tags: |
Aggiungi Tag
Nessun Tag, puoi essere il primo ad aggiungerne!!
|
| _version_ | 1866910291053248512 |
|---|---|
| author | Schneider, Simon Ferreyra, Nicolás E. Díaz Quéval, Pierre-Jean Simhandl, Georg Zdun, Uwe Scandariato, Riccardo |
| author_facet | Schneider, Simon Ferreyra, Nicolás E. Díaz Quéval, Pierre-Jean Simhandl, Georg Zdun, Uwe Scandariato, Riccardo |
| contents | Models of software systems are used throughout the software development lifecycle. Dataflow diagrams (DFDs), in particular, are well-established resources for security analysis. Many techniques, such as threat modelling, are based on DFDs of the analysed application. However, their impact on the performance of analysts in a security analysis setting has not been explored before. In this paper, we present the findings of an empirical experiment conducted to investigate this effect. Following a within-groups design, participants were asked to solve security-relevant tasks for a given microservice application. In the control condition, the participants had to examine the source code manually. In the model-supported condition, they were additionally provided a DFD of the analysed application and traceability information linking model items to artefacts in source code. We found that the participants (n = 24) performed significantly better in answering the analysis tasks correctly in the model-supported condition (41% increase in analysis correctness). Further, participants who reported using the provided traceability information performed better in giving evidence for their answers (315% increase in correctness of evidence). Finally, we identified three open challenges of using DFDs for security analysis based on the insights gained in the experiment. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2401_04446 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | How Dataflow Diagrams Impact Software Security Analysis: an Empirical Experiment Schneider, Simon Ferreyra, Nicolás E. Díaz Quéval, Pierre-Jean Simhandl, Georg Zdun, Uwe Scandariato, Riccardo Software Engineering Models of software systems are used throughout the software development lifecycle. Dataflow diagrams (DFDs), in particular, are well-established resources for security analysis. Many techniques, such as threat modelling, are based on DFDs of the analysed application. However, their impact on the performance of analysts in a security analysis setting has not been explored before. In this paper, we present the findings of an empirical experiment conducted to investigate this effect. Following a within-groups design, participants were asked to solve security-relevant tasks for a given microservice application. In the control condition, the participants had to examine the source code manually. In the model-supported condition, they were additionally provided a DFD of the analysed application and traceability information linking model items to artefacts in source code. We found that the participants (n = 24) performed significantly better in answering the analysis tasks correctly in the model-supported condition (41% increase in analysis correctness). Further, participants who reported using the provided traceability information performed better in giving evidence for their answers (315% increase in correctness of evidence). Finally, we identified three open challenges of using DFDs for security analysis based on the insights gained in the experiment. |
| title | How Dataflow Diagrams Impact Software Security Analysis: an Empirical Experiment |
| topic | Software Engineering |
| url | https://arxiv.org/abs/2401.04446 |