Designing security into software
Name
71341503-MIT.pdf
Description
Full printable version
Size
5.76 MB
Format
Adobe PDF
Checksum (MD5)
f72216946f68109141d9509a6e335171
Author(s)
Zhang, Chang Tony
Advisor(s)
Michael A. Cusumano.
Date Issued
2006
Publisher
Massachusetts Institute of Technology
Abstract
When people talk about software security, they usually refer to security applications such as antivirus software, firewalls and intrusion detection systems. There is little emphasis on the security in the software itself. Therefore the thesis sets out to investigate if we can develop secure software in the first place. It first starts with a survey of the software security field, including the definition of software security, its current state and the research having been carried out in this aspect. Then the development processes of two products known for their security: Microsoft IIS 6.0 and Apache HTTP Web Server are examined. Although their approaches to tackle security are seemingly quite different, the analysis and comparisons identify they share a common framework to address the software security problem - designing security early into the software development lifecycle. In the end the thesis gives recommendations as to how to design security into software development process based upon the principles from the research and the actual practices from the two cases. Finally it describes other remaining open issues in this field.
Description
Thesis (S.M.)--Massachusetts Institute of Technology, System Design and Management Program, 2006.
Includes bibliographical references (p. 88-92).
Subjects
System Design and Management Program.
MIT Department
System Design and Management Program.
Terms of Use
M.I.T. theses are protected by copyright. They may be viewed from this source for any purpose, but reproduction or distribution in any format is prohibited without written permission. See provided URL for inquiries about permission.
Persistent DSpace Link
