Secure Software Development in the Era of Fluid Multi-party Open Software and Services

Pushed by market forces, software development has become fast-paced. As a consequence, modern development projects are assembled from 3rd-party components. Security & privacy assurance techniques once designed for large, controlled updates over months or years, must now cope with small, continuous changes taking place within a week, and happening in sub-components that are controlled by third-party developers one might not even know they existed. In this paper, we aim to provide an overview of the current software security approaches and evaluate their appropriateness in the face of the changed nature in software development. Software security assurance could benefit by switching from a process-based to an artefact-based approach. Further, security evaluation might need to be more incremental, automated and decentralized. We believe this can be achieved by supporting mechanisms for lightweight and scalable screenings that are applicable to the entire population of software components albeit there might be a price to pay.

I. Security Head-Scratchers

In the last decade, three major forces radically changed software development projects. First , the trends of DevOps as well as continuous integration and delivery have led to a fast-paced development with faster product changes [1] , [2] . Second , the adoption of agile practices has lead to a democratised process where the development is carried out by self-organizing and cross-functional teams that have limited central oversight [3] . Third , after advocating the benefits of commercial off-the-shelf (COTS) and software reuse for years, we have finally come to the era of multi-stakeholder development and software ecosystems, where developers focus on differentiating features in their products and rely on 3rd parties for everything else (e.g, cloud deployment, use of open frameworks, and so on) [4] . We observe that the key issue is not that it is Free (albeit this is useful), but that it is in a state of constant changes and such changes are done by different people belonging to different organizations. To capture this phenomenon, we introduce the notion of Multi-party Open Software and Services – or MOSS ¹ – and to reflect the dual nature of modern software developer roles, we introduce the notion of MOSS Prosumer : to produce MOSS components, software developers not only develop their own code, but also consume the code from other projects. From a security perspective, the new situation, brings the two major challenges.