Securing Research Software: A Proposal for Threat Modeling

Research software today plays an integral role in the practice of science, and as the complexity and wide-ranging impact of that software continues to grow, so too do concerns about software security. In industry, much attention has been paid to the concept of "shifting security left,” that is, considering security earlier in the software development life cycle (SDLC) rather than at the end. Developers —RSEs included— are non-experts in security, and a major aim of shifting security left is to introduce security-enhancing practices that fit into ordinary developers' workflows. Case in point, threat modeling is a security activity that identifies weaknesses and vulnerabilities during software design that serves as the foundation for the security life cycle. Compared to more complex security activities, threat modeling can be performed by non-security experts if given the proper guidance and support. In the RSE space, security resources are limited and typically focused on more complex security issues. With the proper resources, we propose that RSEs can perform threat modeling with minimal extra effort, thus alleviating pressure on existing security resources and increasing the overall security posture of the team and organization. This poster presents the findings of a rapid literature review on the applicability of threat modeling techniques during the software development lifecycle. We performed a review of the relevant evidence, combining gray and peer-reviewed sources, focusing on 22 high-quality works. Given that RSEs are underrepresented in the software engineering literature, we analyzed available evidence on threat modeling in conventional software development and made a preliminary assessment of the transferability of those findings to RSE contexts. In our review, we answered the following research questions: How is threat modeling incorporated into the development process? How is the security impact of threat modeling during the software development process measured? What is the definition of threat modeling when performed during the software development process? What challenges do software developers face when threat modeling during the software development process? How effective is threat modeling when performed during software development by non-experts in security? The findings of this review will be used to develop a quick reference guide and educational workshop for RSEs to support their threat modeling efforts. This poster allows RSEs to learn more about threat modeling and our work. We invite participants to provide feedback to guide our future work.