security best practices

In software development, selecting appropriate security features is challenging due to ambiguous standards, framework-specific vulnerabilities, and the absence of traceable, implementation-level security feature identifiers. Method: This paper proposes a fine-grained, implementation-oriented security feature taxonomy comprising 68 extensible characteristics; establishes systematic mappings between these features and major security standards (e.g., ISO/IEC 27001, NIST SP 800-53); and conducts reverse-engineering–driven, source-code–based feature modeling to empirically assess the support coverage of 21 widely adopted frameworks (e.g., Spring Security, OAuth 2.0). Contribution/Results: We present the first three-layer alignment—across security standards, framework capabilities, and source-code–level features—enabling precise security feature selection, implementation-level traceability, and long-term compliance auditing. The resulting taxonomy provides a structured semantic foundation and end-to-end traceability for secure software engineering.

To address the challenges of complex security control configuration, difficult policy enforcement, and delayed response in networked systems, this paper proposes a Security Capability Model (SCM). The SCM establishes, for the first time, a computable abstract framework integrating information and data models, formally specifying rule semantics, policy parsing mechanisms, and data representations for filtering- and channel-protection–based controls. Leveraging UML/SysML modeling, Model-Driven Engineering (MDE), and a multi-granularity security control description language, the approach enables automated policy refinement, cross-heterogeneous-device (e.g., firewalls, encrypted gateways) configuration generation, and event-driven response. Experimental evaluation demonstrates a threefold improvement in policy deployment timeliness and a 40% increase in configuration accuracy, thereby filling a critical gap in the formal foundations for automated security policy enforcement.

Existing vulnerability management approaches lack systematic reasoning capabilities for the vulnerability posture during system design, hindering proactive security control design. This paper introduces the first automated vulnerability reasoning mechanism tailored for the design phase, leveraging formal modeling and automated reasoning to support end-to-end vulnerability identification, mitigation option generation, and security control specification. The mechanism is deeply integrated into an open-source security design tool and validated in real-world industrial settings: it accurately identifies applicable vulnerabilities and significantly improves both the accuracy and efficiency of security control design, thereby shifting vulnerability management from reactive response to design-driven assurance. Its core contribution lies in establishing verifiable, formal relationships among design artifacts, vulnerabilities, and security controls—addressing a critical gap in automation-enabled security left-shifting.

Early system design suffers from ambiguous access control requirements, uneven distribution of domain knowledge, and cognitive asymmetry among stakeholders. Method: This paper proposes a tool-supported method that embeds asset and goal models as boundary objects into the requirements and architecture phases. It introduces a lightweight UML/SysML-inspired modeling language to explicitly represent access control concerns and integrates model comparison and difference analysis to enhance knowledge transparency and stakeholder alignment. Contribution/Results: The approach enables “shifting access control left” in the development lifecycle. Evaluated in a military aviation reusable component adaptation case, it identified six categories of latent access constraint conflicts, reduced requirement clarification cycles by 40%, and significantly improved cross-role collaboration efficiency.

Prior security development research lacks empirical grounding, particularly regarding engineers’ practical challenges in industrially engineering and maintaining security features (e.g., encryption, access control). Method: We conducted a qualitative study involving semi-structured interviews with 26 experienced practitioners, followed by thematic coding to empirically validate and refine four prevalent industry assumptions. Contribution/Results: We identify three core challenges: (1) ambiguous security trade-off decisions, (2) severe documentation deficits, and (3) excessive maintenance burden during system evolution. We further characterize recurring code patterns and maintenance bottlenecks associated with security features. This work fills a critical gap in empirical security engineering research and provides actionable, evidence-based insights for designing security tools, IDE plugins, and engineering guidelines—thereby bridging the theory–practice divide in secure software development.

This work addresses the critical gap in current software architecture design practices—the absence of effective security assessment mechanisms, which often allows vulnerabilities to persist into later development stages or even production. To bridge this gap, the paper introduces a novel Abstract Penetration Testing Case (APTC) metamodel that enables, for the first time, the automatic generation of security evaluation and penetration testing cases directly from software architecture models. By integrating large language models with tailored prompting strategies, the proposed approach autonomously produces APTCs with high practical utility (93%) and correctness (86%). This capability empowers architects to proactively identify security flaws at the design level and provides actionable guidance for subsequent penetration testing activities.

This work addresses the challenge of efficiently and accurately translating high-level security intents into deployable device-level policies in complex heterogeneous networks, where topological reachability and device capabilities often lead to misconfigurations and delayed responses. To overcome these limitations, the authors propose an end-to-end automated framework that uniquely integrates network topology, device capabilities, and real-time cyber threat intelligence (CTI). By leveraging formal modeling, policy compilation, and constraint solving, the approach automatically refines abstract security intents into concrete, network-compliant filtering rules. Experimental validation in real-world environments demonstrates the system’s ability to correctly generate both packet-filtering and web-filtering policies, confirming its practicality, correctness, and dynamic adaptability to emerging threats.

This work addresses the significant delay between vulnerability disclosure and protective rule deployment in traditional Cloud Security Posture Management (CSPM), which relies on vendor-distributed static rules. The authors propose a demand-driven, dynamic detection architecture that automatically derives, activates, and deactivates detection rules by continuously integrating public vulnerability databases with tenant-specific asset graphs—eliminating the need for manual intervention or centralized rule distribution. The core innovation lies in a novel bidirectional, incremental rule derivation mechanism based on the intersection of assets and vulnerabilities, coupled with formal semantic validation and a complexity-bounded generation algorithm to synchronize rule lifecycles with environmental states. Experimental results demonstrate that the approach reduces protection latency from hours or days to near real-time, with rule set size scaling only with environmental diversity, thereby substantially lowering resource overhead.

This work addresses the challenge of detecting multi-stage attacks that traverse trust boundaries in cloud deployments—threats often missed by conventional security tools due to their inability to model holistic system architecture and runtime behavioral deviations. The authors propose a novel approach that integrates static configuration analysis with runtime network flow observation to automatically construct a platform-agnostic architectural abstraction reflecting the system’s true state, including components, domains, interfaces, policies, and data flows. Building upon this representation, the method enables continuous, architecture-level threat modeling. It is the first to support automated architecture inference and threat detection across bare-metal, Kubernetes, and cloud environments. Evaluated on supply chain systems incorporating machine learning (ML) components, the approach successfully identified all 17 classes of injection threats—including ML-specific threats—substantially outperforming existing tools, which cover only 6–47% of these threats and fail entirely to detect ML-related ones.

This study addresses the security risks arising from semantic mismatches in data that crosses trust boundaries, even when such data passes syntactic validation. It introduces the first systematic definition of the “Trust Boundary Semantic Gap” (TBSG) and proposes a Multidimensional Trust Boundary Semantic Gap (MDTBSG) model that characterizes TBSG along four dimensions: identity, space, time, and interpretation. Furthermore, the work develops the TBSAM framework for the design phase, integrating static specification analysis, semantic alignment modeling, gap provenance tracing, and architectural control mapping to identify, prioritize, and mitigate semantic gaps. Applied retrospectively to the SolarWinds/SUNBURST attack, the approach successfully pinpointed the root cause of critical semantic gaps, clarified assumptions in the receiving domain, and recommended effective architectural controls to disrupt the attack path.

This work addresses the critical security challenge that arises when host-based autonomous agents, given only high-level user objectives, generate execution plans without sufficient semantic constraints—such as process boundaries or safety limits—leading to potentially high-risk behaviors. We propose the first semantics-aware threat model specifically tailored for host agents, systematically analyzing the semantic completion process from abstract goals to executable plans and identifying multiple risk-inducing completion patterns. Through execution trace analysis, a case study on OpenClaw, and explicit modeling of safety boundaries, we derive defensive design principles that constrain hazardous semantic completions and clarify operational boundaries. Our findings offer both theoretical foundations and practical guidance for developing secure and reliable autonomous agent systems.