Pushed by market forces, software development has become fast-paced. As a consequence, modern development projects are assembled from 3rd-party components. Security & privacy assurance techniques once designed for large, controlled updates over months or years, must now cope with small, continuous changes taking place within a week, and happening in sub-components that are controlled by third-party developers one might not even know they existed. In this paper, we aim to provide an overview of the current software security approaches and evaluate their appropriateness in the face of the changed nature in software development. Software security assurance could benefit by switching from a process-based to an artefact-based approach. Further, security evaluation might need to be more incremental, automated and decentralized. We believe this can be achieved by supporting mechanisms for lightweight and scalable screenings that are applicable to the entire population of software components albeit there might be a price to pay.
翻译：在市场力量的推动下,软件的开发速度很快,因此,现代开发项目是从第三方组成部分组装起来的。 安全和隐私保障技术曾经设计过几个月或几年的大规模、受控制更新,现在必须应付一周内发生的小规模、连续的变化,发生在第三方开发商甚至不知道其存在的次级组成部分中。在本文件中,我们的目的是概述目前的软件安全方法,并评估在软件开发性质发生变化的情况下这些方法是否适当。软件安全保障可以通过从基于程序的方法转换为基于人工智能的方法而受益。此外,安全评估可能需要更加渐进、自动化和分散。我们认为,可以通过支持适用于软件组成部分全体的轻量和可扩缩筛选机制来实现这一点,尽管可能要付出代价。
相关内容
微信扫码咨询专知VIP会员