Prácticas de Ciberseguridad en la Ingeniería de Software: Una Revisión de la Literatura
DOI:
https://doi.org/10.32870/recibe.v15i1.496Palabras clave:
Secure Software, SDLC, Software Secure Development, Software Engineering, Systematic Literature Review, Narrative SynthesisResumen
El desarrollo de productos de software que consideren aspectos de ciberseguridad en el diseño sigue representando un reto considerablemente alto para los equipos encargados de su construcción. En la Ingeniería de Software se han implementado diversas prácticas en distintas fases del desarrollo de software que tienen como objetivo construir productos cada vez más seguros, con la finalidad de satisfacer las demandas de la industria. A través de una revisión sistemática de 77 artículos, hemos identificado 30 prácticas relevantes de ciberseguridad, incluyendo políticas de seguridad, modelado de amenazas, análisis estático y pruebas de penetración. También se destacan artefactos clave como diagramas de clases, casos de mal uso y patrones de seguridad, junto con herramientas, modelos, estándares y marcos asociados. Estos hallazgos muestran cómo la ciberseguridad se integra en todas las etapas del ciclo de vida del desarrollo de software, con la finalidad de producir productos de software que satisfagan uno de los atributos de calidad más relevantes en la actualidad.Citas
Lemos, R. (2023, February). Cyberattack on fintech firm disrupts derivatives trading globally. Dark Reading. https://www.darkreading.com/cyberattacks-data-breaches/cyberattack-fintech-firm-disrupts-derivatives-trading
Vijayan, J. (2023, January). How noob website hackers can become persistent threats. Dark Reading. https://www.darkreading.com/cyberattacks-data-breaches/noob-hackers-become-persistent-threats
Vailshery, L. S. (2022, March). Share of corporate data stored in the cloud in organizations worldwide from 2015 to 2022. Statista. https://www.statista.com/statistics/1062879/worldwide-cloud-storage-of-corporate-data/
Sommerville, I. (2011). Software engineering (9th ed.). Addison-Wesley.
Emami, M. S., Ithnin, N. B., & Ibrahim, O. (2010). Software process engineering: Strengths, weaknesses, opportunities and threats. In Proceedings of the 6th International Conference on Networked Computing (INC2010).
Straub, J. (2020). Software engineering: The first line of defense for cybersecurity. In 2020 IEEE 11th International Conference on Software Engineering and Service Science (ICSESS).
González, H., Llamas Contreras, R., & Montaño Rivas, O. (2019). When software engineering meets cybersecurity at the classroom. In 2019 7th International Conference in Software Engineering Research and Innovation (CONISOFT).
Khan, R. A., Khan, S. U., Ilyas, M., & Idris, M. Y. (2020). The state of the art on secure software engineering: A systematic mapping study. In Proceedings of the 24th International Conference on Evaluation and Assessment in Software Engineering (EASE '20).
González, H., Llamas Contreras, R., & Guerra García, C. (2021). Cybersecurity practices at the initial stages of the software engineering process. In 2021 9th International Conference in Software Engineering Research and Innovation (CONISOFT).
Khan, R. A., Khan, S. U., Khan, H. U., & Ilyas, M. (2022a). Systematic literature review on security risks and its practices in secure software development. IEEE Access, 10, 5456–5481.
Khan, R. A., Khan, S. U., & Ilyas, M. (2022b). Exploring security procedures in secure software engineering: A systematic mapping study. In Proceedings of the 26th International Conference on Evaluation and Assessment in Software Engineering (EASE '22).
Selva-Mora, A., & Quesada-López, C. (2024). Security practices in agile software development: A mapping study. In Proceedings of the 7th ACM/IEEE International Workshop on Software-intensive Business (IWSiB '24).
Kitchenham, B. A., Budgen, D., & Brereton, P. (2015). Evidence-based software engineering and systematic reviews. Chapman & Hall/CRC.
Zhang, H., Babar, M. A., & Tell, P. (2011). Identifying relevant studies in software engineering. Information and Software Technology, 53(6), 625–637.
Popay, J., Roberts, H., Sowden, A., Petticrew, M., Arai, L., Rodgers, M., Britten, N., Roen, K., & Duffy, S. (2006). Guidance on the conduct of narrative synthesis in systematic reviews. ESRC Methods Programme. https://www.lancaster.ac.uk/media/lancaster-university/content-assets/documents/fhm/dhr/chir/NSsynthesisguidanceVersion1-April2006.pdf
Abiona, O. O., Oladapo, O. J., Modupe, O. T., Oyeniran, O. C., Adewusi, A. O., & Komolafe, A. M. (2024). The emergence and importance of DevSecOps: Integrating and reviewing security practices within the DevOps pipeline. World Journal of Advanced Engineering Technology and Sciences, 11(2), 127–133.
Check Point. (2024). What is secure SDLC? https://www.checkpoint.com/cyber-hub/cloud-security/what-is-secure-sdlc/
