Software Quality and Security

Security is a core quality attribute according to ISO 25010. It encompasses confidentiality, integrity, availability, and additional aspects such as authenticity.

In a Nutshell

• Security is a quality attribute.
• CIA triad: confidentiality, integrity, availability.
• Security must be considered from the design phase onward.
• Security testing is part of the picture, but insufficient on its own.

The CIA Triad

The CIA triad is the foundational model of information security. It describes the three primary protection goals that every secure system must achieve.

Confidentiality

Confidentiality ensures that sensitive information can only be viewed by authorized individuals. Key measures include encryption, access controls, and authentication.

Integrity

Integrity means that data cannot be altered without detection. Hash functions, digital signatures, and version control help protect it.

Availability

Availability ensures that systems and data are accessible when needed. DDoS attacks and outages can threaten it. Redundancy and monitoring are essential safeguards.

Additional Security Aspects

• Authenticity: Secure identity verification of users and systems.
• Accountability: Traceability of actions and events.
• Non-repudiation: Proof that a particular action occurred.
• Data protection: Safeguarding personal and sensitive information.

Secure Practices

Security by Design

Security is built into architecture and design from the start. Adding security later is costlier and less effective.

Principle of Least Privilege

Every user and process receives only the minimum permissions necessary. This limits damage if an attack succeeds.

Input Validation

All input must be checked for type, length, format, and range. Server-side validation is mandatory, as client-side validation can be bypassed.

Secure Authentication

Strong password policies, salted hashing, rate limiting, MFA, and secure session tokens protect login mechanisms.

Logging and Monitoring

Security-relevant events are logged and monitored. This enables early attack detection and provides an audit trail.

Regular Updates

Security vulnerabilities in frameworks, libraries, and operating systems are patched through updates and releases.

Practical Example

A secure login mechanism exemplifies how security works as a quality attribute in practice. This example is instructive because authentication is a frequent attack target and demonstrates multiple goals from the CIA triad simultaneously. The list below shows how security practices work together concretely.

Secure login:
- Store passwords hashed
- Rate limiting against brute-force attacks
- Enforce HTTPS
- Multi-factor authentication
- Secure session management

Why these measures?

• Store passwords hashed: Protects the confidentiality of credentials even if the database is compromised.
• Rate limiting: Prevents automated attacks and maintains system availability.
• Enforce HTTPS: Protects data in transit and ensures integrity.
• Multi-factor authentication: Increases authenticity even if a password is known.
• Secure session management: Prevents session hijacking and ensures accountability.

These measures demonstrate that security is not a single tool but an orchestration of design, implementation, and operations.

Pros and Cons

Pros	Cons
Protects user data and privacy	Additional development effort
Builds trust and reputation	Increased architectural complexity
Meets compliance requirements	Must balance with usability
Enables early attack detection	Requires ongoing maintenance and updates
Competitive advantage through credibility	Requires specialized security expertise
Reduces costs through early defect prevention	False positives and effort in tool management

Key Exam Points

• ISO 25010: Security is its own characteristic with sub-attributes like confidentiality, integrity, availability, and authenticity.
• CIA triad: Confidentiality, integrity, and availability are the three pillars of information security.
• Security by Design: Security must be considered during the design phase.
• Principle of Least Privilege: Grant only the permissions absolutely necessary.
• Input Validation: Validate all input server-side to prevent injection and other attacks.
• Secure Authentication: Password hashing, MFA, rate limiting, and secure sessions.
• Logging and Monitoring: Log and monitor security-relevant events.
• Regular Updates: Keep frameworks, libraries, and systems current.
• Data Protection: Protect personal data according to GDPR and similar regulations.
• Threat Modeling: Systematically analyze threats during design.
• Defense in Depth: Multiple layers of security rather than a single measure.
• Security vs. Security Testing: Security is the quality attribute; security testing is the verification method.

Key References

1. https://owasp.org/www-project-top-ten/
2. https://iso25000.com
3. https://en.wikipedia.org/wiki/Information_security

Continue on the Software Quality Learning Path

The next article in the Software Quality Learning Path covers Software Quality and Performance — how performance becomes a quality attribute.