• norsk
    • English
  • English 
    • norsk
    • English
  • Login
View Item 
  •   Home
  • SINTEF
  • Publikasjoner fra CRIStin
  • Publikasjoner fra CRIStin - SINTEF AS
  • View Item
  •   Home
  • SINTEF
  • Publikasjoner fra CRIStin
  • Publikasjoner fra CRIStin - SINTEF AS
  • View Item
JavaScript is disabled for your browser. Some features of this site may not work without it.

Challenges and Experiences with Applying Microsoft Threat Modeling in Agile Development Projects

Cruzes, Daniela Soares; Jaatun, Martin Gilje; Bernsmed, Karin; Tøndel, Inger Anne
Journal article, Peer reviewed
Accepted version
Thumbnail
View/Open
Threat_modelling-aswec-2018_final.pdf (343.0Kb)
URI
http://hdl.handle.net/11250/2644850
Date
2018
Metadata
Show full item record
Collections
  • Publikasjoner fra CRIStin - SINTEF AS [6311]
  • SINTEF Digital [2706]
Original version
10.1109/ASWEC.2018.00023
Abstract
The goal of secure software engineering is to create software that keeps performing as intended even when exposed to attacks. Threat modeling is considered to be a key activity, but can be challenging to perform for developers, and even more so in agile software development. Hence, threat modeling has not seen widespread use in agile software projects. The goal of this paper is to investigate the challenges facing adoption of threat modeling using the Microsoft approach with STRIDE. We performed a case study in a company comprising five agile development projects. We identified 21 challenges to threat modeling that emerged from our observations. We then mapped these challenges to challenges found in the literature. Some challenges overlap the findings from the literature; the extra challenges we have found in our exploratory study came mostly from the activities of asset identification and also from our observations on what happened after the threat modeling meetings. This study shows that we still have to address many challenges in order to get a proper adoption of threat modeling in agile development projects.
Description
© 2018 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.
Publisher
IEEE
Journal
2018 25th Australasian Software Engineering Conference (ASWEC)

Contact Us | Send Feedback

Privacy policy
DSpace software copyright © 2002-2019  DuraSpace

Service from  Unit
 

 

Browse

ArchiveCommunities & CollectionsBy Issue DateAuthorsTitlesSubjectsDocument TypesJournalsThis CollectionBy Issue DateAuthorsTitlesSubjectsDocument TypesJournals

My Account

Login

Statistics

View Usage Statistics

Contact Us | Send Feedback

Privacy policy
DSpace software copyright © 2002-2019  DuraSpace

Service from  Unit