Security principles for package management as part of software development lifecycle and processes

Abstract

Use of third-party software packages has become increasingly popular in software projects. Reusing source code via packages can help developers focus on writing the parts of the software that are unique to their application and relying on third-party source code to solve common problems that have already been solved by others. However, the use of packages does not come without risks. By introducing a dependency on someone else’s code, members of software project teams should recognize and be aware of security implications and risks associated with such decisions. Usually such decisions are opaque and made on ad-hoc basis by individuals taking part in the software project. This thesis aims to introduce a set of principles for managing and remediating security problems associated with software packages. The principles are tied to a software development lifecycle and processes by introducing various steps that can be incorporated as software package management process and workflow to existing and new software projects.