Continuously integrating security
Abstract
Continuous deployment is a software engineering process where incremental software changes are automatically tested and frequently deployed to production environments. With continuous deployment, the elapsed time for a change made by a developer to reach a customer can now be measured in days or even hours. To understand the emerging practices surrounding continuous deployment, three annual one-day Continuous Deployment Summits have been held at Facebook, Netflix, and Google in 2015--2017, where 17 companies have described how they used continuous deployment. This short paper will describe the practices and environment used by these companies as they strive to develop secure and privacy-preserving products while making ultra-fast changes.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Using unsuitable performance metrics for security evaluation is a DevOps security challenge.
“We reviewed those studies briefly and extracted all the challenging factors including lack of secure coding standards [2], [23], [80], [81], using unsuitable performance metrics for security evaluation [2], [69], [78], [79] and lack of integrated testing tools to secure DevOps [14], [52], [53], [71].”
From Prioritization based taxonomy of DevOps security challenges using PROMETHEE (2020) · cites this paper as [2]
Lack of secure coding standards is a DevOps security challenge.
“We reviewed those studies briefly and extracted all the challenging factors including lack of secure coding standards [2], [23], [80], [81], using unsuitable performance metrics for security evaluation [2], [69], [78], [79] and lack of integrated testing tools to secure DevOps [14], [52], [53], [71].”
From Prioritization based taxonomy of DevOps security challenges using PROMETHEE (2020) · cites this paper as [2]
Lack of automated testing tool performance measures for security is a DevOps security challenge.
“We have also identified lack of automated testing tool performance measures for security [2], [5], [20], [23], [24] as a critical challenge that have a negative impact on DevOps security.”
From Prioritization based taxonomy of DevOps security challenges using PROMETHEE (2020) · cites this paper as [2]
Cites
The Top 10 Adages in Continuous Deployment
Parnin, C., Helms, E., Atlee, C., Boughton, H., Ghattas, M., Glover, A., Holman, J., Micco, J., Murphy, T. B., Savor, T., et al. (2017) · IEEE Software · doi:10.1109/ms.2017.86 · Cited by 87 · see citing works
Self-citation
Flagged first, then by citations
Cited by
Sorted by citations
Prioritization based taxonomy of DevOps security challenges using PROMETHEE
Rafi, S., Yu, W., Akbar, M. A., Alsanad, A., & Gumaei, A. (2020) · IEEE Access · doi:10.1109/access.2020.2998819 · Cited by 50 · see citing works
Integrating Security with DevSecOps: Techniques and Challenges
Ahmed, Z., & Francis, S. C. (2019) · 2019 International Conference on Digitization (ICD) · doi:10.1109/icd47981.2019.9105789 · Cited by 44 · see citing works
DevSecOps: A Security Model for Infrastructure as Code Over the Cloud
Ibrahim, A. A., Yousef, A. H., & Medhat, W. (2022) · International Mobile, Intelligent, and Ubiquitous Computing Conference (MIUCC) · doi:10.1109/miucc55081.2022.9781709 · Cited by 27 · see citing works
Putting the Sec in DevSecOps: Using Social Practice Theory to Improve Secure Software Development
Ashenden, D., & Ollis, G. (2020) · New Security Paradigms Workshop · doi:10.1145/3442167.3442178 · Cited by 20 · see citing works
Quantitative DevSecOps Metrics for Cloud-Based Web Microservices
Zhang, J. Y., & Zhang, Y. (2024) · IEEE Access · doi:10.1109/access.2024.3486314 · Cited by 11 · see citing works
Dealing with Security in a Real DevOps Environment
Larrucea, X., Berreteaga, A., & Santamaría, I. (2019) · Communications in computer and information science · doi:10.1007/978-3-030-28005-5_35 · Cited by 11 · see citing works
AGILE AND SECURE SOFTWARE DEVELOPMENT: AN UNFINISHED STORY
(2019) · Issues in Information Systems · doi:10.48009/1_iis_2019_144-156 · Cited by 9 · see citing works
TOWARDS AN AGILE ITSM MATURITY FRAMEWORK FOR ORGANIZATIONS : A CASE STUDY
Sahid, A., Maleh, Y., & Mounir, S. (2022) · EDPACS · doi:10.1080/07366981.2022.2045541 · Cited by 5 · see citing works
Systematic Literature Review: Software Engineering FrameworksPreprint
Prates, L., & Pereira, R. (2022) · Research Square · doi:10.21203/rs.3.rs-1637463/v1
Security and Privacy Concern in Ultra-Dense V2X Communication NetworkPreprint
Haider, A. (2023) · doi:10.31219/osf.io/qv8uf
- Authors
- Williams, L.
- Affiliations
- North Carolina State University (US)
- Corresponding author
- Williams, Laurie
- ORCID
- Williams, Laurie
- Venue
- Proceedings of the 1st International Workshop on Security Awareness from Design to Deployment
- Publisher
- ACM
- Published
- 2018-05-27
- Pages
- 1-2
- OpenAlex
- W2889302230
- Cited by
- 10
- References
- 1
- Citations by year
- 2024: 1 · 2023: 1 · 2022: 3 · 2020: 2 · 2019: 3
- FWCI
- 0.98
- Type
- conference paper
- Language
- en
- Open access
- closed
- Topics
- Physical Sciences › Computer Science › Information Systems › Software Engineering Techniques and Practices
- Physical Sciences › Computer Science › Computer Networks and Communications › Software System Performance and Reliability
- Physical Sciences › Computer Science › Information Systems › Software Engineering Research
- Keywords
- continuous deployment, software security, privacy preservation, continuous integration, test automation, large-scale software development
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
