Software assurance (SwA) is a critical process in software development that ensures the reliability, safety, and security of software products.[1] It involves a variety of activities, including requirements analysis, design reviews, code inspections, testing, and formal verification. One crucial component of software assurance is secure coding practices, which follow industry-accepted standards and best practices, such as those outlined by the Software Engineering Institute (SEI) in their CERT Secure Coding Standards (SCS).[2]
Another vital aspect of software assurance is testing, which should be conducted at various stages of the software development process and can include functional testing, performance testing, and security testing.[3] Testing helps to identify any defects or vulnerabilities in software products before they are released. Furthermore, software assurance involves organizational and management practices like risk management and quality management to ensure that software products meet the needs and expectations of stakeholders.[4]
Software assurance aims to ensure that software is free from vulnerabilities and functions as intended, conforming to all requirements and standards governing the software development process.[3] Additionally, software assurance aims to produce software-intensive systems that are more secure. To achieve this, a preventive dynamic and static analysis of potential vulnerabilities is required, and a holistic, system-level understanding is recommended. Architectural risk analysis plays an essential role in any software security program, as design flaws account for 50% of security problems, and they cannot be found by staring at code alone.[5]
By following industry-accepted standards and best practices, incorporating testing and management practices, and conducting architectural risk analysis, software assurance can minimize the risk of system failures and security breaches, making it a critical aspect of software development.
- ^ Stavrou, A., Bos, H., Portokalidis, G., & van der Meyden, R. (2017). Software assurance: a roadmap. 60(1), 71-79: Communications of the ACM.
{{cite book}}: CS1 maint: location (link) CS1 maint: multiple names: authors list (link) - ^ SEI (n.d). CERT Secure Coding Standards. Software Engineering Institute.
- ^ ISO (2015). ISO/IEC/IEEE 12207:2015 - Systems and software engineering -- Software life cycle processes. ISO.
- ^ IEEE (2019). IEEE 730-2019 - IEEE Standard for Software Quality Assurance Processes. IEEE.
- ^ McGraw, Gary (2006). Software Security: Building Security In. Addison-Wesley. p. 75. ISBN 0-321-35670-5.