Work

Defining Security Debt: A Case Study Based On Practice

Year: 2024

Type: conference-paper

Abstract: Background: Implementing security standards is important to ensure proper functioning and avoid malicious attacks. Neglecting security can lead to Security Debt (SD), which can be disruptive. However, the industry does not have a generally accepted definition of SD thus far. Aims: This exploratory case study aims to provide a definition of SD, to find the relation between SD and Technical Debt (TD), to find the difference between SD and security vulnerabilities, and to identify SD accumulation patterns. Method: We interviewed 26 software practitioners from an international conglomerate of several software companies. Results: We propose a multifaceted SD definition. SD is a subset of TD, and security vulnerabilities have, to a varying degree, been shown to be part of SD. Conclusion: Our results can provide a clearer view of how practitioners perceive SD, facilitating its management.

Source: Zenodo (CERN European Organization for Nuclear Research)

DOI: 10.5281/zenodo.13759166

Authors: Kruke, Maren Maritsdatter, Martini, Antonio, S. Cruzes, Daniela, Iovan, Monica

Institutions: Visma (Norway), University of Oslo, Norwegian University of Science and Technology

Language: English

Topic: Software Engineering Techniques and Practices

Subfield: Information Systems

Field: Computer Science

Domain: Physical Sciences

Open Access status: green

Funder: Norges Forskningsråd

Award: G3534501190