Secure Scrum: Development of Secure Software with Scrum
Christoph Pohl, Hans-Joachim Hof

TL;DR
Secure Scrum integrates security considerations into the agile Scrum process, enabling non-security experts to develop more secure software without altering team dynamics, as demonstrated by a field test showing improved security levels.
Contribution
It introduces Secure Scrum, a variation of Scrum that emphasizes security throughout development without changing the core process or team structure.
Findings
Higher security levels achieved with Secure Scrum
Non-security experts can effectively identify and implement security features
Secure Scrum does not alter standard Scrum team dynamics
Abstract
Nowadays, the use of agile software development methods like Scrum is common in industry and academia. Considering the current attacking landscape, it is clear that developing secure software should be a main concern in all software development projects. In traditional software projects, security issues require detailed planning in an initial planning phase, typically resulting in a detailed security analysis (e.g., threat and risk analysis), a security architecture, and instructions for security implementation (e.g., specification of key sizes and cryptographic algorithms to use). Agile software development methods like Scrum are known for reducing the initial planning phases (e.g., sprint 0 in Scrum) and for focusing more on producing running code. Scrum is also known for allowing fast adaption of the emerging software to changes of customer wishes. For security, this means that it is…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsSoftware Engineering Techniques and Practices · Information and Cyber Security · Software Engineering Research
