Preliminary Evaluation of a Software Security Learning Environment

Study of Development Support for Software Security Based on Knowledge Management Approach

The SHIELDS project aimed at constructing a repository-based secure software engineering environment (Hakon, et al., 2009). The goal of the project is to store and share security models that represent the expertise of experts. The repository model shown corresponds to the knowledge base we describe in this paper.

Barnum and McGraw proposed a knowledge structure for software security whose goal is to form an infrastructure for software security practices (Barnum & McGraw, 2005). They represented the knowledge structure as a class diagram of seven classes (“Principle,” “Guideline,” “Rule,” “Attack pattern,” “Vulnerability,” “Exploit,” and “Historical risk”) and their relationships. We think the knowledge structure proposed by Barnum and McGraw corresponds to the knowledge base we proposed. Our study aims at constructing a learning environment (storing artifacts, association of created artifacts with the knowledge base, and recording the rationale) in which learners conduct secure software development, referring to the knowledge base.