DSFS 2014 - Development of Security Features Using Scrum Workshop

Development of Security Features Using Scrum Workshop
Dr. Lotfi ben Othmane
Laboratory for Quality Software (LaQuSo), Department of Mathematics and Computer Science,
Eindhoven University of Technology (TU/e), Eindhoven, The Netherlands
l.ben.othmane-AT-tue.nl
General Information
Workshop duration is One day
The primary convener for the workshop is Dr.Lotfi ben Othmane
The workshop includes a hands-on component
Description
Scrum, being an agile development method, is commonly known to be not compatible with the common process of developing secure software, mainly because it is an iterative and incremental method. This tutorial discusses developing security features, such as secure communication between two parties using the Scrum method and ensuring the feature is secure. The main objectives are to show how we integrate a set of activities into Scrum to enable producing acceptably secure features and how to structure the development iterations to iteratively and incrementally develop security features and ensure they are secure.
The tutorial starts with an overview of Scrum and the required activities to develop secure software and we demonstrate attacks on security features. Next, we show how we integrate a set of security development activities into the Scrum development process to produce secure features. Then, we discuss how to structure the development iterations such that it is possible to produce acceptably secure increment of the feature at the end of each iteration. We simulate the use of the method through the case study: secure communication between a sensor and a Web server, which communicate through cellular network.