2026-09-18T22:52:45Zhttps://dspace.mit.edu/server/oai/request

oai:dspace.mit.edu:1721.1/350982022-01-13T07:55:19Zcom_1721.1_7582com_1721.1_7581col_1721.1_131023

Michael A. Cusumano. Zhang, Chang Tony System Design and Management Program. System Design and Management Program. 2006-12-18T20:40:35Z 2006-12-18T20:40:35Z 2006 2006 http://hdl.handle.net/1721.1/35098 71341503 Thesis (S.M.)--Massachusetts Institute of Technology, System Design and Management Program, 2006. Includes bibliographical references (p. 88-92). When people talk about software security, they usually refer to security applications such as antivirus software, firewalls and intrusion detection systems. There is little emphasis on the security in the software itself. Therefore the thesis sets out to investigate if we can develop secure software in the first place. It first starts with a survey of the software security field, including the definition of software security, its current state and the research having been carried out in this aspect. Then the development processes of two products known for their security: Microsoft IIS 6.0 and Apache HTTP Web Server are examined. Although their approaches to tackle security are seemingly quite different, the analysis and comparisons identify they share a common framework to address the software security problem - designing security early into the software development lifecycle. In the end the thesis gives recommendations as to how to design security into software development process based upon the principles from the research and the actual practices from the two cases. Finally it describes other remaining open issues in this field. by Chang Tony Zhang. S.M. 96 p. 4555630 bytes 4560535 bytes application/pdf application/pdf eng Massachusetts Institute of Technology M.I.T. theses are protected by copyright. They may be viewed from this source for any purpose, but reproduction or distribution in any format is prohibited without written permission. See provided URL for inquiries about permission. http://dspace.mit.edu/handle/1721.1/7582 System Design and Management Program. Designing security into software Thesis application/pdf false Publication unknown unknown <Publication xmlns="https://www.openaire.eu/cerif-profile/1.1/" id="f724af62-b405-4782-9a5c-8c03f331a625"> <Type xmlns="https://www.openaire.eu/cerif-profile/vocab/COAR_Publication_Types">http://purl.org/coar/resource_type/c_1843</Type> <Language>eng</Language> <Title>Designing security into software</Title> <PublishedIn> <Publication> </Publication> </PublishedIn> <PublicationDate>2006</PublicationDate> <Authors> <Author> <DisplayName>Zhang, Chang Tony</DisplayName> <Affiliation> <OrgUnit> </OrgUnit> </Affiliation> </Author> </Authors> <Editors> </Editors> <Publishers> <Publisher> <DisplayName>Massachusetts Institute of Technology</DisplayName> <OrgUnit /> </Publisher> </Publishers> <License>http://dspace.mit.edu/handle/1721.1/7582</License> <Keyword>System Design and Management Program.</Keyword> <Abstract>When people talk about software security, they usually refer to security applications such as antivirus software, firewalls and intrusion detection systems. There is little emphasis on the security in the software itself. Therefore the thesis sets out to investigate if we can develop secure software in the first place. It first starts with a survey of the software security field, including the definition of software security, its current state and the research having been carried out in this aspect. Then the development processes of two products known for their security: Microsoft IIS 6.0 and Apache HTTP Web Server are examined. Although their approaches to tackle security are seemingly quite different, the analysis and comparisons identify they share a common framework to address the software security problem - designing security early into the software development lifecycle. In the end the thesis gives recommendations as to how to design security into software development process based upon the principles from the research and the actual practices from the two cases. Finally it describes other remaining open issues in this field.</Abstract> <Access xmlns="http://purl.org/coar/access_right" > </Access> </Publication>