Paper Info
Title
Evaluation of the Pattern-based method for Secure Development (PbSD): A controlled experiment
Abstract
Context: Security in general, and database protection from unauthorized access in particular, are crucial for organizations. Although it has been long accepted that the important system requirements should be considered from the early stages of the development process, non-functional requirements such as security tend to get neglected or dealt with only at later stages of the development process. Objective: We present an empirical study conducted to evaluate a Pattern-based method for Secure Development - PbSD - that aims to help developers, in particular database designers, to design database schemata that comply with the organizational security policies regarding authorization, from the early stages of development. The method provides a complete framework to guide, enforce and verify the correct implementation of security policies within a system design, and eventually generate a database schema from that design. Method: The PbSD method was evaluated in comparison with a popular existing method that directly specifies the security requirements in SQL and Oracle's VPD. The two methods were compared with respect to the quality of the created access control specifications, the time it takes to complete the specification, and the perceived quality of the methods. Results: We found that the quality of the access control specifications using the PbSD method for secure development were better with respect to privileges granted in the table, column and row granularity levels. Moreover, subjects who used the PbSD method completed the specification task in less time compared to subjects who used SQL. Finally, the subjects perceived the PbSD method clearer and more easy to use. Conclusion: The pattern-based method for secure development can enhance the quality of security specification of databases, and decrease the software development time and cost. The results of the experiment may also indicate that the use of patterns in general has similar benefits; yet this requires further examinations.
Year
DOI
Venue
2012
10.1016/j.infsof.2012.04.001
Information & Software Technology
Keywords
Field
DocType
controlled experiment,pbsd method,database schema,popular existing method,early stage,security policy,secure development,organizational security policy,development process,pattern-based method,access control specification,authorization,database design
SQL,Data mining,Software engineering,Computer science,Oracle,Database design,Database schema,Access control,Security policy,System requirements,Software development
Journal
Volume
Issue
ISSN
54
9
0950-5849
Citations 
PageRank 
References 
2
0.35
31
Authors
3
Name
Order
Citations
PageRank
Jenny Abramov1403.46
Arnon Sturm241044.76
Peretz Shoval3765134.06