Um estudo comparativo entre processos de desenvolvimento de software seguro

Abstract

Information security is a large and complex area within computer science. However, the concern of developers to keep systems protected from external and internal threats has caused the software industry and researchers to turn their attention to include security requirements during development. This work aims to analyze development processes that formally incorporate information security and that appear more frequently in the literature, to then de ne parameters and develop a comparative study between them. This study selected 5 vulnerabilities listed in the CVE database and sought to identify at which point in the software development lifecycle, based on the recommendations of the Microsoft SDL and OWASP CLASP models, the vulnerability would be avoided or mitigated.