A Taxonomy of Functional Security Features and How They Can Be Located
Kevin Hermann, Simon Schneider, Catherine Tony, Asli Yardim, Sven Peldszus, Thorsten Berger, Riccardo Scandariato, M. Angela Sasse, Alena Naiakshina

TL;DR
This paper presents a detailed taxonomy of 68 security features, analyzes their coverage in popular frameworks, and discusses how these features are represented in source code to improve security feature implementation and location.
Contribution
It introduces a comprehensive taxonomy of security features, maps them to standards, and evaluates their presence in frameworks, aiding developers in secure system development.
Findings
Developed a taxonomy of 68 security features.
Mapped features to widely used security standards.
Analyzed coverage of features in 21 security frameworks.
Abstract
Security must be considered in almost every software system. Unfortunately, selecting and implementing security features remains challenging due to the variety of security threats and possible countermeasures. While security standards are intended to help developers, they are usually too abstract and vague to help implement security features, or they merely help configure such. A resource that describes security features at an abstraction level between high-level (i.e., rather too general) and low-level (i.e., rather too specific) security standards could facilitate secure systems development. To realize security features, developers typically use external security frameworks, to minimize implementation mistakes. Even then, developers still make mistakes, often resulting in security vulnerabilities. When security incidents occur or the system needs to be audited or maintained, it is…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
