发现重要的安全威胁：行业案例研究
Finding Security Threats That Matter: An Industrial Case Study
摘要：
软件工程的最新趋势（即，敏捷，DevOps）缩短了开发生命周期，限制了用于软件设计安全分析的资源。在这种情况下，架构模型（通常是手动）分析潜在的安全威胁。风险最后威胁分析建议在确定优先级之前识别所有安全威胁。相比之下，风险优先的威胁分析建议在威胁之前识别风险，绕过威胁优先级。这对于开发速度非常重要的组织来说似乎很有希望。然而，很少有经验证据存在的影响，牺牲系统性的高优先级威胁的性能和威胁分析的执行。为此，我们与汽车领域的工业专家进行了案例研究，在那里我们根据经验比较了风险优先技术和风险最后技术。在本研究中，我们有意识地改变参与者的数量，以在实践中对威胁分析会话进行更真实的模拟。这使我们能够密切观察工业专家，并深入了解工业实践。这项工作有助于：（i）性能的定量比较，（ii）执行的定量和定性比较，以及（iii）两种技术的比较讨论。我们发现，在发现高优先级的安全威胁的生产力和及时性没有差异。然而，我们发现分析执行的差异。特别是，使用风险优先技术的参与者发现了两倍的高优先级威胁，开发了详细的攻击场景，并详细讨论了威胁的可行性。另一方面，使用风险最后技术的参与者发现了更多的中低优先级威胁，并提前完成了任务。
英文摘要：
Recent trends in the software engineering (i.e., Agile, DevOps) have shortened the development life-cycle limiting resources spent on security analysis of software designs. In this context, architecture models are (often manually) analyzed for potential security threats. Risk-last threat analysis suggests identifying all security threats before prioritizing them. In contrast, risk-first threat analysis suggests identifying the risks before the threats, by-passing threat prioritization. This seems promising for organizations where developing speed is of great importance. Yet, little empirical evidence exists about the effect of sacrificing systematicity for high-priority threats on the performance and execution of threat analysis. To this aim, we conduct a case study with industrial experts from the automotive domain, where we empirically compare a risk-first technique to a risk-last technique. In this study, we consciously trade the amount of participants for a more realistic simulation of threat analysis sessions in practice. This allows us to closely observe industrial experts and gain deep insights into the industrial practice. This work contributes with: (i) a quantitative comparison of performance, (ii) a quantitative and qualitative comparison of execution, and (iii) a comparative discussion of the two techniques. We find no differences in the productivity and timeliness of discovering high-priority security threats. Yet, we find differences in analysis execution. In particular, participants using the risk-first technique found twice as many high-priority threats, developed detailed attack scenarios, and discussed threat feasibility in detail. On the other hand, participants using the risk-last technique found more medium and low-priority threats and finished early.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
