Comparação entre frameworks de desenvolvimento de software com foco nas principais features de segurança em um sistema web bancário

Abstract

There is a growing industry demand for web systems in various application domains (finance, smart cities, and precision agriculture). In this context, the possibility of security failures and attacks on these systems increases, as they may be accessible on the web by anyone. The software industry faces challenges in ensuring the effective security of web systems. Security testing is conducted during and after software development to identify vulnerabilities and security flaws, which is a costly process requiring agile team efforts. In an attempt to minimize failures and attacks, security practices have been adopted from the inception of software. These practices are described by secure development frameworks that offer software security features. This work aims to compare and model the main security features in two secure development frameworks: BSA Framework for Secure Software and NIST Secure Software Development Framework, with a focus on enhancing security in web systems. This comparison will be carried out by representing the practices of each framework in feature models and defining security configurations for each framework analyzed. The security practices will be applied in the development process of two modules of a banking web system: authentication and money transfer. The modules will be evaluated in the context of security flaws and attacks based on the most common vulnerabilities identified in a literature review for web systems. This work aims to: (i) create representations of the practices of each framework through feature models; (ii) define security configurations at the design level for each framework, selecting key practices related to secure development; (iii) adapt the development frameworks in the context of security in a web system; and (iv) develop two secure modules for a banking web system. Lastly, it aims to establish a preliminary body of knowledge on the main security features by comparing the frameworks to minimize failures and attacks in web systems.