{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,10]],"date-time":"2026-06-10T16:39:38Z","timestamp":1781109578079,"version":"3.54.1"},"reference-count":42,"publisher":"IGI Global Scientific Publishing","issue":"4","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2010,10]]},"abstract":"<jats:p>Software Assurance is the planned and systematic set of activities that ensures software processes and products conform to requirements while standards and procedures in a manner that builds trusted systems and secure software. While absolute security may not yet be possible, procedures and practices exist to promote assurance in the software lifecycle. In this paper, the authors present a framework and step-wise approach towards achieving and optimizing assurance by infusing security knowledge, techniques, and methodologies into each phase of the Software Development Lifecycle (SDLC).<\/jats:p>","DOI":"10.4018\/jsse.2010100104","type":"journal-article","created":{"date-parts":[[2011,2,15]],"date-time":"2011-02-15T15:59:11Z","timestamp":1297785551000},"page":"62-80","source":"Crossref","is-referenced-by-count":0,"title":["Assimilating and Optimizing Software Assurance in the SDLC"],"prefix":"10.4018","volume":"1","author":[{"given":"Aderemi O.","family":"Adeniji","sequence":"first","affiliation":[{"name":"University of North Carolina at Charlotte, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Seok-Won","family":"Lee","sequence":"additional","affiliation":[{"name":"University of North Carolina at Charlotte, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"2432","reference":[{"key":"jsse.2010100104-0","author":"J. H.Allen","year":"2010","journal-title":"A Look at Software Security Engineering: A Guide for Project Managers"},{"key":"jsse.2010100104-1","year":"2004","journal-title":"Does Eveyrone Struggle As Much As We Do?"},{"key":"jsse.2010100104-2","unstructured":"Bishop, M., & Davis, U. C. (2006). Foundations of Computer and Information Security \u2013 Requirements (Lecture No. 26)."},{"key":"jsse.2010100104-3","author":"P.Bishop","year":"2004","journal-title":"The Future of Goal-Based Assurance Cases"},{"key":"jsse.2010100104-4","unstructured":"Chandra, P. (2010). Open Web Application Security Project (OWASP). Software Assurance Maturity Model: A Guide to Building Security into Software Development v1. Retrieved from http:\/\/www.opensamm.org\/downloads\/SAMM-1.0.pdf"},{"key":"jsse.2010100104-5","unstructured":"Common Vulnerabilities and Exposures (CVE). (n.d.). Community list. MITRE. Retrieved http:\/\/cve.mitre.org\/"},{"key":"jsse.2010100104-6","unstructured":"Common Weakness Enumeration (CWE). (n.d.). Community list. MITRE. Retrieved http:\/\/cwe.mitre.org\/"},{"key":"jsse.2010100104-7","unstructured":"Department of Defense (DoD). (1997). DoD Information Technology Security Certification and Accreditation Process (DITSCAP). Washington, DC: DoD."},{"key":"jsse.2010100104-8","author":"R. J.Ellison","year":"2006","journal-title":"Security and Project Management"},{"key":"jsse.2010100104-9","unstructured":"Failure Causes Statistics. (1995). The Bull Survey (1998), KPMG Canada Survey (1997), and Chaos Report (1995). Retrieved from http:\/\/www.it-cortex.com\/Stat_Failure_Cause.htm"},{"key":"jsse.2010100104-10","author":"K.Goertzel","year":"2007","journal-title":"Software Security Assurance: A State-of-the-Art Report"},{"key":"jsse.2010100104-11","unstructured":"Goodenough, J., Lipson, H., & Weinstock, C. (2008). Arguing Security \u2013 Creating Security Assurance Cases. Pittsburgh, PA: Carnegie Mellon University. Retrieved from https:\/\/buildsecurityin.us-cert.gov\/daisy\/bsi\/articles\/knowledge\/assurance\/643-BSI.html"},{"issue":"3","key":"jsse.2010100104-12","first-page":"32","article-title":"Misuse and Abuse Cases: Getting Past the Positive.","volume":"2","author":"P.Hope","year":"2004","journal-title":"IEEE Building Security in Security & Privacy Magazine"},{"key":"jsse.2010100104-13","article-title":"A Strategic Initiative of the U.S. Department of Homeland Security to Promote Integrity, Security, and Reliability in Software","author":"J.Jarzombek","year":"2006","journal-title":"Considerations in Advancing the National Strategy to Secure Cyberspace"},{"key":"jsse.2010100104-14","unstructured":"Jarzombek, J. (2007). Software Assurance: A Strategic Initiative of the U.S. Department of Homeland Security to Promote Integrity, Security, and Reliability in Software. In Proceedings of the Enabling Role and a Broader Perspective for Measurement."},{"key":"jsse.2010100104-15","unstructured":"Joint Holders in Australia\/New Zealand, Canada, France, Germany, Japan, Netherlands, Spain, United Kingdom and United States. (2006). Common Criteria for Information Technology Security Evaluation, Version 3.1, Revision 1."},{"key":"jsse.2010100104-16","unstructured":"Joint Task Force Transformation Initiative. (2009). National Institute of Standards and Technology (NIST) Special Publication 800-53 revision 3, Recommended Security Controls for Federal Information Systems and Organizations."},{"key":"jsse.2010100104-17","unstructured":"J\u00fcrjens, J. (2001). Towards Development of Secure Systems using UMLsec. In Proceedings of the Fundamental Approaches to Software Engineering (FASE\/ETAPS) 2001, International Conference. Berlin: Springer Verlag."},{"key":"jsse.2010100104-18","unstructured":"J\u00fcrjens, J. (2002). UMLsec Presenting the Profile. In Proceedings of the 6th Annual Workshop on Distributed Objects and Components Security (DOCsec2002), Baltimore, MD."},{"key":"jsse.2010100104-19","unstructured":"J\u00fcrjens, J. (2003). Critical Systems Development with UML. In Proceedings of the 21st IASTED International Multi-Conference Applied Informatics, International Conference on Software Engineering."},{"key":"jsse.2010100104-20","author":"J.J\u00fcrjens","year":"2004","journal-title":"Secure Systems Development with UML"},{"key":"jsse.2010100104-21","unstructured":"Kass, M. (2005). A Taxonomy of Software Assurance Tools and the Security Bugs they Catch. In Proceedings of the OWASP AppSec DC."},{"key":"jsse.2010100104-22","author":"S. W.Lee","year":"2006","journal-title":"Requirements as Enables for Software Assurance"},{"key":"jsse.2010100104-23","author":"H.Lipson","year":"2008","journal-title":"Evidence of Assurance: Laying the Foundation for a Credible Security Case"},{"key":"jsse.2010100104-24","author":"S.Mancoridis","year":"2008","journal-title":"Software Vulnerabilities: Definition, Classification, and Prevention"},{"key":"jsse.2010100104-25","author":"G. E.McGraw","year":"2005","journal-title":"Risk Management Framework"},{"key":"jsse.2010100104-26","author":"P. G.Neumann","year":"1994","journal-title":"Computer-Related Risks"},{"key":"jsse.2010100104-27","author":"G. L.Oar","year":"1998","journal-title":"The Benefits of Applying the DoD Information Technology Security Certification and Accreditation Process to Commercial Systems and Applications"},{"key":"jsse.2010100104-28","unstructured":"Open Vulnerability and Assessment Language (OVAL). (n.d.). Community list. MITRE. Retrieved from http:\/\/oval.mitre.org\/"},{"key":"jsse.2010100104-29","author":"S. L.Pfleeger","year":"2005","journal-title":"Software Engineering Theory and Practice"},{"key":"jsse.2010100104-30","unstructured":"Poseidon for UML by GentleWare. (n.d.). Retrieved from http:\/\/www.gentleware.com\/"},{"key":"jsse.2010100104-31","unstructured":"Redwine, S. (2007). Introduction to Assurance Cases. In Proceedings of the OMG Software Assurance Workshop."},{"key":"jsse.2010100104-32","author":"L.Rosencrance","year":"2007","journal-title":"Survey: Poor Communication Causes Most IT Project Failures"},{"key":"jsse.2010100104-33","author":"R.Ross","year":"2007","journal-title":"NIST Special Publication 800-53A"},{"key":"jsse.2010100104-34","author":"R.Ross","year":"2004","journal-title":"NIST Special Publication 800-37"},{"key":"jsse.2010100104-35","unstructured":"SAFECode. (2008). Software Assurance: An Overview of Current Industry Best Practices. Software Assurance Forum for Excellence in Code (SAFECode). Retrieved from http:\/\/www.safecode.org\/publications\/SAFECode_BestPractices0208.pdf"},{"key":"jsse.2010100104-36","author":"P.Shabalin","year":"2004","journal-title":"Model Checking UMLsec"},{"key":"jsse.2010100104-37","author":"D.Sinclair","year":"2005","journal-title":"Introduction to Assurance"},{"key":"jsse.2010100104-38","author":"E. A.Strunk","year":"2006","journal-title":"The Essential Synthesis of Problem Frames and Assurance Cases"},{"key":"jsse.2010100104-39","author":"S.Welke","year":"2004","journal-title":"Security Certification & Accreditation: DITSCAP vs. DCID 6\/3"},{"key":"jsse.2010100104-40","author":"D.Wheeler","year":"2003","journal-title":"Secure Programmer: Developing Secure Programs"},{"key":"jsse.2010100104-41","unstructured":"Wheeler, D. (n.d.). Flawfinder. Retrieved from http:\/\/www.dwheeler.com\/flawfinder\/"}],"container-title":["International Journal of Secure Software Engineering"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.igi-global.com\/viewtitle.aspx?TitleId=48217","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2019,2,19]],"date-time":"2019-02-19T11:33:20Z","timestamp":1550576000000},"score":1,"resource":{"primary":{"URL":"http:\/\/services.igi-global.com\/resolvedoi\/resolve.aspx?doi=10.4018\/jsse.2010100104"}},"subtitle":["A Framework and Step-Wise Approach"],"short-title":[],"issued":{"date-parts":[[2010,10]]},"references-count":42,"journal-issue":{"issue":"4"},"URL":"https:\/\/doi.org\/10.4018\/jsse.2010100104","relation":{},"ISSN":["1947-3036","1947-3044"],"issn-type":[{"value":"1947-3036","type":"print"},{"value":"1947-3044","type":"electronic"}],"subject":[],"published":{"date-parts":[[2010,10]]}}}