Software Security Assurance with an Augmented Software Component Analysis Approach for Open Source Component Evaluation

Open source components are the foundation of modern software development, thereby making software component analysis (SCA) as an essential method to ensuring software security. However, existing SCA methods concentrate on identifying open source component's security issues, ignoring comprehensive analysis with components' maintenance and support posture. In this paper, we investigated the literature from industry and academia about secure software development process, software and component evaluation models, and evaluation methodologies. Then, we proposed advanced open source component analysis (AOSCA), an augmented SCA approach by additionally quantifying a set of attributes for evaluation, despite of the conventional detected issues. The experimental results demonstrate that AOSCA can effectively assessing open source components and provide the evaluation result to software development organisation based on requirements and preference. To sum up, AOSCA provides a comprehensive but effective mechanism for open source component evaluation. Applying AOSCA as a security practice during software development process is vital for software security assurance.