HITSSSE
More and more small and medium-sized enterprises (SMEs) are developing software for their own infrastructure or products. This work is usually carried out under significant time pressure, and personnel resources are often limited. Agile software development methods are also increasingly being used to deliver solutions that can be deployed quickly. As a result, the security of this software often takes a back seat, which ultimately affects the IT security of these companies and their customers. The HITSSSE research project aims to improve IT security through secure software development for SMEs. To this end, the research project will develop recommendations for action and technical tools, which will first be tested in practice by the project’s associated partners, with the goal of subsequently creating generic solutions for small and medium-sized enterprises in Germany. Through collaboration with the “IT Security in Business” transfer office, the project aims to broaden the impact of the solutions developed.
The HITSSSE research project investigated how the IT security of SMEs can be enhanced through secure software development. When existing security tools are easy to use and deliver actionable results, the security of the products developed with them increases. By providing clear guidelines and recommendations for action, efficient, agile development processes can be established that incorporate the “security-by-design” principle from the very beginning. This can achieve a lasting effect that enhances the security of products from German SMEs.
The efficient implementation of the HITSSSE project is made possible through the cooperation between the Institute for Innovative Security (THA_innos) and the Innovation Lab at Augsburg University of Applied Sciences (THA_ias). Over the course of three years, the partners analyzed and optimized the development of secure software from three perspectives.
The research project focuses on three areas of software development:
- Software development for application and server software, as operated by many companies for their own purposes
- Software development for embedded systems, e.g., software on industrial devices, as well as various Internet of Things (IoT) devices
- Usability and the human factor as enablers for secure software development
To be able to formulate concrete recommendations for secure processes and the tools used, SMEs were brought in as associated partners; their operations were analyzed, and the solutions developed were piloted there. Their direct involvement was essential and contributed to the acceptance of the approaches developed.
Security Annotation – Marking Security-Sensitive Code
For companies of all sizes, data related to processes, people, or systems represents significant value and is therefore an asset worth protecting. If such data is manipulated or falls into the wrong hands, it can impair a company’s profitability and operational capabilities. That is why Security Annotation was developed to help SMEs get started with IT security. This concept makes it possible to permanently label security-sensitive source code and associate it with assets and potential vulnerabilities. The annotations and the linked additional information are stored on a commit-by-commit basis. This generates documentation that is aligned with the security status of the entire codebase. This documentation is relevant for both developers and project managers in order to integrate software development with risk management.
Security Adventure - The Human Factor
A large proportion of attacks on IT infrastructures can be attributed to the human factor. Phishing emails, tailgating, CEO fraud, baiting—these and many other methods exploit the “human” vulnerability and can grant attackers access to sensitive data and systems. Such attacks can be prevented by focusing on people. Companies should raise awareness of these threats and foster acceptance of security measures.
To support companies in this effort, the HITSSSE project developed a video game that guides players through various security-related challenges in their everyday work. The game serves two purposes. First, “Security Adventure” builds knowledge by playfully addressing specific topics from the broad field of IT security awareness or secure software development. Second, it aims to increase employees’ willingness to engage with the topic of IT security.
The game can be played on a standard PC. Additionally, “Security Adventure” is also available as a classic arcade machine. Combined with the game’s pixel art style, this appeals to employees’ sense of nostalgia while also lowering the barriers to entry.
CI-IN-A-BOX – FULLY ENCAPSULATED CI/CD INFRASTRUCTURE
Attempting to integrate CI/CD pipeline tools into internal infrastructure can often lead to problems. These are frequently caused by configuration issues, especially when embedded hardware is used. To prevent these issues, CI-in-a-Box offers a fully encapsulated CI/CD infrastructure. This provides software developers with a secure platform to test and familiarize themselves with automated CI/CD pipeline processes. The infrastructure is designed with an emphasis on flexibility, reproducibility, and robustness. That’s why CI-in-a-Box is compact and portable—and thus flexible and deployable as needed. Additionally, the software environment can be installed with a single click and reset just as easily. An internal network is set up via an upstream OPNsense. This allows the CI-in-a-Box to be operated separately from the corporate network. To facilitate access to the CI-in-a-Box and the CI/CD processes, sample projects—primarily focused on the embedded sector—are provided to support the use and integration of the platform.
Partners
