Security principles for package management as part of software development lifecycle and processes
Use of third-party software packages has become increasingly popular in software projects. Reusing source code via packages can help developers focus on writing the parts of the software that are unique to their application and relying on third-party source code to solve common problems that have al...
| Main Author: | |
|---|---|
| Other Authors: | , , , , , |
| Format: | Master's thesis |
| Language: | eng |
| Published: |
2019
|
| Subjects: | |
| Online Access: | https://jyx.jyu.fi/handle/123456789/66197 |
| Summary: | Use of third-party software packages has become increasingly popular in software projects. Reusing source code via packages can help developers focus on
writing the parts of the software that are unique to their application and relying
on third-party source code to solve common problems that have already been
solved by others.
However, the use of packages does not come without risks. By introducing
a dependency on someone else’s code, members of software project teams
should recognize and be aware of security implications and risks associated
with such decisions. Usually such decisions are opaque and made on ad-hoc
basis by individuals taking part in the software project.
This thesis aims to introduce a set of principles for managing and remediating security problems associated with software packages. The principles are
tied to a software development lifecycle and processes by introducing various
steps that can be incorporated as software package management process and
workflow to existing and new software projects.
|
|---|