Empirical Research for Software Security Foundations and Experience

Developing secure software requires the integration of numerous methods and tools into the development process, and software design is based on shared expert knowledge, claims, and opinions. Empirical methods, including data analytics, allow extracting knowledge and insights from the data that organizations collect from their processes and tools, and from the opinions of the experts who practice these processes and methods. This book introduces the reader to the fundamentals of empirical research methods, and demonstrates how these methods can be used to hone a secure software development lifecycle based on empirical data and published best practices.

1. Empirical Research on Security and Privacy by Design, Koen Yskout, Kim Wuyts, Dimitri Van Landuyt, Riccardo Scandariato, and Wouter Joosen2. Guidelines for Systematic Mapping Studies in Security Engineering, Michael Felderer and Jeffrey C. Carver3. An Introduction to Data Analytics for Software Security, Lotfi ben Othmane, Achim D. Brucker, Stanislav Dashevskyi, and Peter Tsalovski4. Generating Software Security Knowledge Through Empirical Methods, Rene Noel, Santiago Matalonga, Gilberto Pedraza, Hernan Astudillo, and Eduardo B. Fernandez5. Visual Analytics: Foundations and Experiences in Malware Analysis, Markus Wagner, Dominik Sacha, Alexander Rind, Fabian Fischer, Robert Luh, Sebastian Schrittwieser, Daniel A. Keim, and Wolfgang Aigner6. Analysis of Metrics for Classification Accuracy in Intrusion Detection, Natalia Stakhanova and Alvaro A. Cardenas7. The Building Security in Maturity Model as a Research Tool, Martin Gilje Jaatun8. Agile Test Automation for Web Applications: A Security Perspective, Sandra Domenique Ringmann and Hanno Langweg9. Benchmark for Empirical Evaluation of Web Application Anomaly Detectors, Robert Bronte, Hossain Shahriar, and Hisham Haddad10. Threats to Validity in Empirical Software Security Research, Daniela S. Cruzes and Lotfi ben Othmane

Dr. Lotfi ben Othmane is on the faculty at the Department of Electrical and Computer Engineering, Iowa State University, USA. Previously, he was a Research Scientist and then Head of the Secure Software Engineering department at Fraunhofer SIT, Germany. Lotfi received his Ph.D. from Western Michigan University (WMU), USA, in 2010; the M.S. in computer science from University of Sherbrooke, Canada, in 2000; and the B.S in information systems from University of Sfax, Tunisia, in 1995. He works currently on software security, specifically on (1) the application of empirical methods to address software security challenges and (2) the impact of incremental development on the security of software. Dr. Martin Gilje Jaatun is a Senior Scientist at SINTEF ICT, where he has been employed since 2004. He received his Sivilingeniør degree in Telematics from the Norwegian Institute of Technology (NTH) in 1992, and the Dr.Philos. degree from the University of Stavanger in 2015. Previous positions include scientist at the Norwegian Defence Research Establishment (FFI), and Senior Lecturer in information security at the Bodø Graduate School of Business. His research interests include software security, security in cloud computing, and security of critical information infrastructures. Dr. Jaatun is an associate editor of the International Journal of Secure Software engineering. He is vice chairman of the Cloud Computing Association (cloudcom.org), vice chairman of Cloud Security Alliance Norway, and a Senior Member of the IEEE. Dr. Edgar Weippl is Research Director of SBA Research and Associate Professor at the Vienna University of Technology. His research focuses on applied concepts of IT security. He has published numerous articles in journals and more than 100 papers in peer-reviewed conferences. After graduating with a Ph.D. from the Vienna University of Technology, he worked in a research startup for two years. He then spent one year teaching as an assistant professor at Beloit College, WI. From 2002 to 2004, he was a Consultant for a Health Maintenance Organization (HMO) in New York and Albany, NY, and for Deutsche Bank, Frankfurt, Germany. In 2004 he joined the Vienna University of Technology and co-founded SBA Research. Dr. Weippl has edited a large number of special issues in journals such as Information Security Technical Report and Computers & Security.