search menu icon-carat-right cmu-wordmark

Composing Effective Software Security Assurance Workflows

Technical Report
In an effort to determine how to make secure software development more cost effective, the SEI conducted a research study to empirically measure the effects that security tools—primarily automated static analysis tools—had on costs and benefits.
Publisher

Software Engineering Institute

CMU/SEI Report Number
CMU/SEI-2018-TR-004
DOI (Digital Object Identifier)
10.1184/R1/12363056.v1

Abstract

In an effort to determine how to make secure software development more cost effective, the SEI conducted a research study to empirically measure the effects that security tools—primarily automated static analysis tools—had on costs (measured by developer effort and schedule) and benefits (measured by defect and vulnerability reduction). The data used for this research came from 35 projects in three organizations that used both the Team Software Process and at least one automated static analysis (ASA) tool on source code or source code and binary. In every case quality levels improved when the tools were used, though modestly. In two organizations, use of the tools reduced total development effort. Effort increased in the third organization, but defect removal costs were reduced compared to the costs of fixes in system test. This study indicates that organizations should employ ASA tools to improve quality and reduce effort. There is some evidence, however, that using the tools could “crowd out” other defect removal activities, reducing the potential benefit. To avoid overreliance, the tools should be employed after other activities where practicable. When system test cycles require expensive equipment, ASA tools should pre-cede test; otherwise, there are advantages to applying them after system test.

Cite This Technical Report

Nichols, B., McHale, J., Sweeney, D., Snavely, W., & Volkmann, A. (2018, October 18). Composing Effective Software Security Assurance Workflows. (Technical Report CMU/SEI-2018-TR-004). Retrieved February 27, 2024, from https://doi.org/10.1184/R1/12363056.v1.

@techreport{nichols_2018,
author={Nichols, Bill and McHale, James and Sweeney, David and Snavely, William and Volkmann, Aaron},
title={Composing Effective Software Security Assurance Workflows},
month={Oct},
year={2018},
number={CMU/SEI-2018-TR-004},
howpublished={Carnegie Mellon University, Software Engineering Institute's Digital Library},
url={https://doi.org/10.1184/R1/12363056.v1},
note={Accessed: 2024-Feb-27}
}

Nichols, Bill, James McHale, David Sweeney, William Snavely, and Aaron Volkmann. "Composing Effective Software Security Assurance Workflows." (CMU/SEI-2018-TR-004). Carnegie Mellon University, Software Engineering Institute's Digital Library. Software Engineering Institute, October 18, 2018. https://doi.org/10.1184/R1/12363056.v1.

B. Nichols, J. McHale, D. Sweeney, W. Snavely, and A. Volkmann, "Composing Effective Software Security Assurance Workflows," Carnegie Mellon University, Software Engineering Institute's Digital Library. Software Engineering Institute, Technical Report CMU/SEI-2018-TR-004, 18-Oct-2018 [Online]. Available: https://doi.org/10.1184/R1/12363056.v1. [Accessed: 27-Feb-2024].

Nichols, Bill, James McHale, David Sweeney, William Snavely, and Aaron Volkmann. "Composing Effective Software Security Assurance Workflows." (Technical Report CMU/SEI-2018-TR-004). Carnegie Mellon University, Software Engineering Institute's Digital Library, Software Engineering Institute, 18 Oct. 2018. https://doi.org/10.1184/R1/12363056.v1. Accessed 27 Feb. 2024.

Nichols, Bill; McHale, James; Sweeney, David; Snavely, William; & Volkmann, Aaron. Composing Effective Software Security Assurance Workflows. CMU/SEI-2018-TR-004. Software Engineering Institute. 2018. https://doi.org/10.1184/R1/12363056.v1