CoChat
Sign Up
Cited by 21Software Engineering Techniques and PracticesWeb Application Security VulnerabilitiesInformation and Cyber Security

FOBICS: Assessing project security level through a metrics framework that evaluates DevSecOps performance

Open access
Caniglia, Alessandro, Dentamaro, Vincenzo, Galantucci, Stefano, Impedovo, Donato·2025·Information and Software Technology
DOI 10.1016/j.infsof.2024.107605
Open this paper in CoChat — free account

Abstract

In today’s software development landscape, the DevSecOps approach has gained traction due to its focus on the software development process and bolstering security measures in projects, a task in light of the ever-evolving cybersecurity threats. This study aims to address the lack of metrics for quantitatively assessing its efficacy from both security and business logic perspectives. To tackle this issue, the research introduces the Framework of Business Index Concerning Security (FOBICS), a set of metrics designed to enable transparent evaluations of project security. FOBICS considers various perspectives relevant to DevSecOps practices. It includes factors such as project duration and financial outcomes, making it appealing for implementation in business settings. The effectiveness of FOBICS is validated theoretically and empirically via its application in two real-world projects: the results from these implementations show a correlation between FOBICS metrics and the security strategies employed as the development methodologies adopted by diverse teams throughout the projects. Hence, FOBICS emerges as a tool for assessing and continuously monitoring project security, offering insights into areas of strength and areas that may require enhancement. FOBICS is shown to be effective in assessing the level of DevSecOps implementation. The ease of calculating FOBICS metrics makes them easily interpretable and continuously verifiable. Moreover, FOBICS summarizes most of the other quantitative and qualitative metrics in the literature. • DevSecOps challenges were analysed to identify metrics to assess project performance • A framework of metrics is proposed. The degree of Security and Testing is evaluated • FOBICS is compared with other metrics, showing how it can summarize many of them • The framework is applied to two real projects and the values obtained are evaluated

Integrity signals

Registry

Crossref · 10.1016/j.infsof.2024.107605

Cites

54 of 54 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

We couldn’t retrieve this paper’s full text, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Caniglia et al. [44] propose the Framework of Business Index Concerning Security (FOBICS) to assess security and testing practices while factoring in project duration and financial outcomes.

    “Caniglia et al. [44] investigate the challenges of implementing DevSecOps by proposing a set of metrics aimed at evaluating project performance, culminating in the introduction of the Framework of Business Index Concerning Security (FOBICS).This framework is designed to assess both security and testing practices while factoring in project duration and financial outcomes, thereby enabling organisat”

    From Evolution of DevSecOps and Its Influence on Application Security: A Systematic Literature Review (2025) · cites this paper as [44]

  • A notable gap in FOBICS is its limited guidance on the operationalisation and continuous improvement of security practices over time.

    “A notable gap in FOBICS is its limited guidance on the operationalisation and continuous improvement of security practices over time.”

    From Evolution of DevSecOps and Its Influence on Application Security: A Systematic Literature Review (2025) · cites this paper as [44]

  • The authors validate FOBICS through its application in two real-world projects, demonstrating a positive correlation between FOBICS-derived metrics and the effectiveness of implemented security strategies.

    “The authors validate FOBICS through its application in two realworld projects, demonstrating a positive correlation between FOBICS-derived metrics and the effectiveness of implemented security strategies.”

    From Evolution of DevSecOps and Its Influence on Application Security: A Systematic Literature Review (2025) · cites this paper as [44]

  • FOBICS does not sufficiently address how organisations can adapt the metrics in response to emerging security challenges, changes in technology stacks, or shifts in regulatory requirements.

    “The framework does not sufficiently address how organisations can adapt the metrics in response to emerging security challenges, changes in technology stacks, or shifts in regulatory requirements.”

    From Evolution of DevSecOps and Its Influence on Application Security: A Systematic Literature Review (2025) · cites this paper as [44]

  • FOBICS lacks explicit mechanisms for integrating feedback from security incidents or post-mortem analyses.

    “Furthermore, FOBICS lacks explicit mechanisms for integrating feedback from security incidents or post-mortem analyses, which are essential for iterative enhancement of security posture in dynamic development environments.”

    From Evolution of DevSecOps and Its Influence on Application Security: A Systematic Literature Review (2025) · cites this paper as [44]

Cites

Flagged first, then by citations

1 of the 55 references couldn’t be matched to a known paper.

Cited by

Sorted by citations

Related

Authors
Caniglia, A., Dentamaro, V., Galantucci, S., & Impedovo, D.
Affiliations
University of Bari Aldo Moro (IT)
Corresponding author
Galantucci, Stefano
ORCID
Venue
Information and Software Technology
Publisher
Elsevier BV
Published
2025-02
Volume
178
Pages
107605
ISSN
0950-5849 (ISSN-L)
DOI
10.1016/j.infsof.2024.107605
OpenAlex
W4403710955
Cited by
18
References
55
Citations by year
2026: 9 · 2025: 9
FWCI
6.79
Type
journal article
Language
en
Open access
Licence
Locations
  • Information and Software Technology (publishedVersion, cc-by-nc-nd)
  • CINECA IRIS Institutional Research Information System (University of Bari Aldo Moro) (submittedVersion, cc-by-nc-nd)
Funders
European Commission (H93C22000620001, PE0000014)
Topics
  • Physical Sciences › Computer Science › Information Systems › Software Engineering Techniques and Practices
  • Physical Sciences › Computer Science › Information Systems › Web Application Security Vulnerabilities
  • Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
Keywords
DevSecOps, security metrics, security performance evaluation, software security, security testing, security maturity, software development projects

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review