Artifacts: An Approach for Reviewing Security Related Apects in Agile Requirements Specifications of Web Applications

<p>Abstract&mdash;Defects in requirements specifications can have&nbsp;severe consequences during the software development lifecycle.&nbsp;Some of them result in overall project failure due to incorrect or&nbsp;missing quality characteristics. Security is one of those uality&nbsp;characteristics that need to be considered in early phases. There&nbsp;are several concerns that make security difficult to deal with; for&nbsp;instance, (1) when stakeholders discuss general requirements in&nbsp;(review) meetings, they are often not aware that they should also discuss security-related topics, and in the rather rare cases they&nbsp;are aware (2), they typically do not have sufficient security&nbsp;expertise. This picture is even more challenging in agile&nbsp;development contexts, where lightweight documentation are typically involved. To address these issues, we designed an&nbsp;approach that considers user stories and security specifications&nbsp;as input and relates those user stories to security properties via&nbsp;Natural Language Processing (NLP) techniques. Based on the&nbsp;related security properties, our approach then identifies high-level security requirements from the Open Web Application&nbsp;Security Project (OWASP) to be verified afterwards. In a last&nbsp;step, the verification of the generated security requirements is then conducted via a focused reading technique. We&nbsp;finally validate our approach via a controlled experiment comparing the&nbsp;effectiveness and efficiency of novice inspectors (we used two&nbsp;different groups of students) verifying security aspects in agile&nbsp;requirements using our generated reading techniques against&nbsp;using the complete list of OWASP high level security&nbsp;requirements and a the same list of defect types embedded in our technique. The (statistically significant) results indicate that&nbsp;using the reading technique has a positive impact (with large&nbsp;effect size) on the performance of inspectors in terms of&nbsp;effectiveness and efficiency.&nbsp;</p> <p>This repository also contains:</p> <p>Artifacts used and results of the experimental study of the paper&nbsp;entitled &quot;An Approach for Reviewing Security Related Apects in Agile Requirements Specifications of Web Applications&quot;.</p>