Políticas para desenvolvimento de software seguro em times ágeis

Abstract

The values and principles of agile methodology ain to aggregate value to the business in a quick manner, being this agility, one of the critics factors for the successof this approaches. This success is crucial to attend the constant rising demand forsoftware, generated by the necessity of digital transformation. Currently, another concern, also resulting of this necessity, has gained more visibility, the cyber secu-rity. A lot of companies that have migrated for the digital world did not have thedue caution with the present threats in this scenery. As consequence, many security problems have being espoused in this past few years, this problems, tent to resultin social and financial losses. Software being one of the computational assets with the biggest expulser to this threats, the search for cyber security tend to become ademand. In this scenery, emerge the necessity to include security practices to the everyday live of the agile team. With the intent to contribute to the resolution ofthis task, this paper has as his goal to: establish cyber security policies, aggregating practices destined to the inclusion of security attributes to software projects, being developed for agile teams. To achieve this, it was necessary to perform a exploratory research through a bibliographic survey, to obtain an initial understanding of the problem and of the main approaches used to solve it. From the bibliography that itwas found it was considered only the research that present practices that included cyber security activities on software projects. Based on predefined criteria, an initialfiltering of the surveyed practices was conducted. The resulting subset was evaluatedby an agile development team with security expertise. The result of this evaluation evidenced the 14 (fourteen) most relevant practices and the stages of the development process to which they belonged. From the selected practices, five (5) policieswere structured and organized, then evaluated by experts, through interviews, tojudge their benefits for safety and applicability in agile teams. From the result of this assessment, it was concluded that 3 (three) of the policies were sufficiently ap-plicable to agile teams and contribute to project safety. Already 2 (two) of them,despite the security benefits, still need adjustments to make the incorporation viablein the agile world.