Research article
A Framework for Secure Software Engineering in Hybrid Agile Software Development
https://doi.org/10.47836/pjst.34.4.14KeywordsHybrid agile, qualitative analysis, secure software engineering, Software Development Lifecycle (SDLC), software security framework
Article content
Abstract
This study examines how Secure Software Engineering (SSE) practices can be applied while developing with Hybrid Agile methods. The Hybrid Agile approach combines disciplined planning and extensive documentation, which are the hallmarks of traditional software development, with flexibility, incremental delivery and quick adoption for changing requirements contributed by Agile practices. Generally, existing secure software engineering frameworks only support either classical or Agile methods. As a result, Hybrid Agile implementations rarely provide enough guidance to integrate security throughout the full development life cycle. The purpose of this research is to investigate the current utilisation of secure software engineering practices in Hybrid Agile to identify and introduce security-focused coding elements designed for those environments. In line with the qualitative research approach being used, we evaluate current secure software practices in Hybrid Agile project implementation. In this study, interviews with professional programmers in diverse business sectors were conducted. It is evident that there is a lack of standardised security practices and that it is crucial for managers and project managers to encourage and support these. In addition, it is important that this study highlights the importance of automation tools in secure software engineering practices. With these findings in mind, this paper provides a structured approach for these organisations seeking to integrate security into Hybrid Agile projects and for improving the reliability and integrity of their software applications. The shift towards proactive environments in hybrid software applications requires an assessment of their software development life cycle to deal with security weaknesses and build tools for detecting possible threats in their applications.
