Artifacts: An Efficient Approach for Reviewing Security-Related Aspects in Agile Requirements Specifications of Web Applications

<strong>Abstract:</strong> Defects in requirements specifications can have severe consequences during the software development lifecycle. Some of them result in time and cost overruns due to incorrect or missing quality characteristics, such as security. This characteristic requires special attention in web applications because they have become a target for manipulating sensible data. Several concerns make security difficult to deal with. For instance, (1) when stakeholders discuss general requirements they are often unaware that they should also discuss security-related aspects, because (2) they typically do not have enough expertise in security. This often leads to unspecified or ill-defined security requirements. These concerns become even more challenging in agile contexts, where lightweight documentation is typically produced. To tackle this problem, we designed an approach for reviewing security-related aspects in agile requirements specifications of web applications. Our proposal considers user stories and security specifications as inputs and relates those user stories to security properties via Natural Language Processing. Based on the related security properties, our approach identifies high-level security requirements from the Open Web Application Security Project (OWASP) to be verified, and generates a reading technique to support reviewers in detecting defects. We evaluate our approach via three experiment trials conducted with 56 novice software engineers, measuring effectiveness, efficiency, usefulness, and ease of use. We compare our approach against using: (1) the OWASP high-level security requirements, and (2) a perspective-based approach as proposed in contemporary state of the art. The results strengthen our confidence that using our approach has a positive impact (with large effect size) on the performance of inspectors in terms of effectiveness and efficiency. The files below contains the following data: <strong>1) Consent form.docx</strong>: This document provides to the research subjects information to decide whether to participate in a research study or not based on an explanation of the proposed research and the nature of the participation that is requested of them. <strong>2) Characterization_Questionnaire.docx:</strong> This document shows the questions used to characterize the working experience and knowledge of the participants of the controlled experiment. The answers obtained through this questionnaire allowed us to identify some key characteristics about three knowledge areas: Agile Software Development, Software Security and Software Inspection. <strong>3) Experiment_Results.xlsx: </strong>This Excel document shows a summary of the results of the experiments by participant ID, trial and technique. It also synthesizes the defects found by the reviewers and the characterization, follow up and TAM questionnaire. <strong>4) FollowUp_Questionnaire_AdHoc_Technique.docx: </strong>This document shows the questions used to acquire information about the review conducted by inspectors who used the ad hoc technique. <strong>5) FollowUp_Questionnaire_Reading_Technique.docx: </strong>This document shows the questions used to acquire information about the review conducted by inspectors who used the proposed reading technique. <strong>6) Repository of Keywords.docx: </strong>This document shows the keywords used by our proposed approach and that indicate some security concern. <strong>7) Task_description_AdHoc_A.docx: </strong>This document shows textual instructions on how to follow the ad hoc review for a set of user stories. <strong>8) Task_description_AdHoc_B.docx: </strong>This document shows textual instructions on how to follow the ad hoc review for another set of user stories. <strong>9) Task_description_RT_A.docx: </strong>This document shows textual instructions on how to follow the proposed reading technique for a set of user stories. <strong>10) Task_description_RT_B.docx: </strong>This document shows textual instructions on how to follow the proposed reading technique for another set of user stories.<strong> </strong> <strong>11) Training_Experiment.pptx: </strong>This document contains the material used to explain the topics involved in the experiment. It was used to train the subjects.摘要：需求规格说明书中的缺陷会在软件开发全生命周期中造成严重后果。其中部分缺陷会因安全等质量特性存在错误或缺失，导致项目时间与成本超支。此类特性在Web应用中需要格外关注，因为Web应用已成为操纵敏感数据的攻击目标。诸多因素使得安全问题难以应对：其一，当项目干系人讨论通用需求时，往往未意识到还应涵盖安全相关内容；其二，他们通常缺乏足够的安全领域专业知识。这常会导致安全需求未被明确指定或定义模糊。在通常仅产出轻量化文档的敏捷开发场景中，此类问题的挑战更为突出。 为解决该问题，我们设计了一种面向Web应用敏捷需求规格说明书的安全相关内容评审方法。我们的方案以用户故事（User Story）与安全规格说明书作为输入，并通过自然语言处理（Natural Language Processing, NLP）将用户故事与安全属性关联起来。基于关联得到的安全属性，我们的方法可从开放Web应用安全项目（OWASP）的高层安全需求中筛选出待验证内容，并生成评审阅读技术以辅助评审人员检测缺陷。 我们邀请56名新手软件工程师开展了3组实验，以此评估该方法，评估维度包括有效性、效率、实用性与易用性。我们将该方法与两种方案进行对比：一是直接使用OWASP高层安全需求，二是采用当前前沿研究中提出的基于视角的评审方法。实验结果证实，该方法对评审人员的评审绩效（有效性与效率维度）具有显著正向影响（效应量较大）。 本次公开的数据集包含以下文件： 1) 知情同意书.docx：该文档向研究受试者提供研究背景说明与参与要求的相关信息，供其自主决定是否参与本研究。 2) 特征描述问卷.docx：该文档包含用于刻画受控实验参与者工作经验与知识储备的问题，通过该问卷收集的回答可帮助我们梳理参与者在三个领域的关键特征：敏捷软件开发、软件安全与软件评审。 3) 实验结果.xlsx：该Excel文档汇总了按参与者ID、实验分组与评审方法统计的实验结果，同时整合了评审人员发现的缺陷信息，以及特征描述问卷、跟踪问卷与技术接受模型（Technology Acceptance Model, TAM）问卷的相关数据。 4) 特设技术跟踪问卷.docx：该文档包含用于收集使用特设评审技术的评审人员相关评审信息的问题。 5) 评审阅读技术跟踪问卷.docx：该文档包含用于收集使用本文提出的评审阅读技术的评审人员相关评审信息的问题。 6) 关键词库.docx：该文档列出了我们提出的方法所使用的、用于标识安全相关问题的关键词。 7) 特设评审A任务说明.docx：该文档包含针对一组用户故事的特设评审操作文本指南。 8) 特设评审B任务说明.docx：该文档包含针对另一组用户故事的特设评审操作文本指南。 9) 评审阅读技术A任务说明.docx：该文档包含针对一组用户故事的本文提出的评审阅读技术操作文本指南。 10) 评审阅读技术B任务说明.docx：该文档包含针对另一组用户故事的本文提出的评审阅读技术操作文本指南。 11) 实验培训材料.pptx：该文档包含用于讲解实验相关主题的培训素材，用于对受试者开展培训。