Identification and Prioritization of Critical Cyber Security Challenges and Practices for Software Vendor Organizations in Software Development: An AHP-Based Systematic Approach

doi:10.21203/rs.3.rs-2250026/v1

Small to medium enterprise (SME) organizations are enormous in number and don't have the controls set up to prevent effective attacks of cybersecurity. The majority of the attacks are conducted when the legitimate information check is not valid and because of the absence of arrangement in applying present-day classifications, for example, 'virus', 'worm', and 'trojan'. The need for cybersecurity showed up in the early years of the digital era when the initial mainframe computer systems were designed. Many software application systems are at risk of attacks if there is a rigorous adherence to leading-edge concepts of encryption and decryption. To deal with all issues, a detailed systematic literature review (SLR) study is conducted to identify the cybersecurity challenges faced by vendor organizations during software development. Through SLR, 13 challenges have been identified, which have a frequency of >=25%. The recognized cybersecurity challenges are “Security issues/Access of Cyberattacks”, “Lack of Right Knowledge”, “Framework”, “Lack of Technical Support”, “Disaster Issues”, “Cost Security issues”, “Lack of Confidentiality and Trust”, “Lack of Management”, “Unauthorized Access issues”, “Lack of Resources”, “Lack of Metrics”, “Administrative Mistakes during Development” and “Lack of Quality, Liability, and Reliability”. All these cybersecurity challenges are classified into awareness, management, security and eminence. An Analytic Hierarchy Process (AHP) approach prioritize and recognize the significance of each identified critical cybersecurity challenge. We also apply this method to practices recognized for these critical cybersecurity challenges.

Cyber Security

challenges

SLR

vendor

AHP

The number of cyberattack survivors is also steadily increasing [1]. A cyberattack must first get access to the target framework; this is known as an admission, and it is typically followed by an exploit. The impacts of the adventure stage can incorporate information breaks like Defective system operation, Denial of service (DoS), Destruction of data systems, Exfiltration of information, Information expulsion or defilement, Unauthorized information access, and others [2]. One of the most well-known types of cybercrime is posting false information on public forums for informal communication to criticize and smear the target or to make false claims that will likely damage the target's reputation. In over 40% of incidents that have been made public, fake profiles have been created on sites for unofficial contact for these purposes [3]. The inclusion of data security breaks by significant papers in itself, recommends that they have significant monetary outcomes and may bring about standing expenses for the impacted firms [4]. For instance, there may be extensive public scrutiny of the resources a company commits to security when the association or its product is highly recognizable. In such a situation, presuming the group makes no expenditures, it may acquire a reputation for having poor or inadequate security. As a result, attacks can increase since the association is a more alluring target than those who are perceived as properly managing their risks [5]. Consumer confidence in a company's products could be compromised by negative publicity and reputation loss resulting from reports of data foundation infringement [6, 7]. The 2007 cyber-attacks on Estonia comprised of DDoS attacks that damaged the nation's banks and parliament abilities [8]. Additionally, makers frequently misrepresent guarantees of profoundly productive assurance, here and there past the extent of genuine security. In specific situations, this confirmation can conceal dangers, it's to say, misdirecting [9]. The majority of the attacks were conducted when the legitimate information check was not valid and because of the absence of arrangement in applying present-day classifications, for example, 'virus', 'worm', and 'trojan' [10]. A typical opinion that can be unsafe is that it is protected all of the time to visit locals that were already protected. The least demanding method for getting sensitive data is by moving toward the clients or managers and deceiving them [11].

The Australian Computer Crime and Security Survey (ACC) revealed a decline in attacks of numerous types while the Information and Security Breaches Survey (ISBS) observed the level of attacked UK organizations had expanded by a third north of two years, and 43 percent of the CSI part associations reviewed experienced expansions in the speed of attacks. During a similar period, the Deloitte-Touche study discovered that monetary area security breaks in the US had remained generally something similar. Understanding the source of attacks is also dangerous [12]. Without a comprehension of intentions, it is hard for regulation requirement offices and government handle cybercrime [13]. The creative security of a framework is frequently strong, but the role and shortcomings of the human in that framework are sometimes unknown or underappreciated. According to U.S. Government studies, many basic framework managers lack the necessary awareness of the threat that insiders pose [14]. As businesses have come to understand the importance of safety, evaluating their financial worth has ultimately been put to the test [15]. Implementing cybersecurity regulations that are specific to different energy framework should be subspaces to assist various security administrations and security approaches to compel the range of cooperation [16].

To answer these cybersecurity challenges, we have formulated two (02) research questions which are as under:

RQ1. What practices are discussed in the literature that should be adopted to overcome cyber security issues that have a negative impact on the software industry?

RQ2. How to allocate the values to the identified challenges and how do categorize and prioritize the critical challenges?

A total of thirteen (13) cyber security issues that adversely affect the software industry during software development have been recognized, and from the 67 articles that were ultimately chosen by SLR, 86 practices have been recognized that can assist in resolving these issues.

The paper is divided into following sections. In Section 2, all relevant methods and techniques are explained. Section 3 explained the use of SLR along with 13 identified challenges. In section 4, practices of 13 challenges are discussed and section 5 concludes the paper.

Social variables could significantly impact how well cyber security capabilities operate if they are not taken into account [14]. Expert risks can range from management errors to actions taken by dissatisfied employees [19]. The vulnerability window for "zero-day exploits" begins when a developer develops a software application including an unidentified vulnerability (or recognized if willful). "Zero-day exploits" (real software application that makes use of the protection opening to perform a strike) are utilized or common by assailants previously the developer of the target software application understands the vulnerability [20]. We always pay much less focus to procedural elements of protection [21]. They tend to just concentrate on making sure that demands have been effectively conducted [22]. After the enactment of the Computer Software application Copyright Act of 1980, it was clear that there are special property rights in the software application. Intellectual property rights offer special accessibility to details. Fragmented property rights in security-relevant expertise. The suggestion behind the property rights (PRs) method is to offer rewards for efficient tasks. Expertise products—or details items in general—cannot just be offered. Software application came to be an item within the currently expanding software application market. Present strategies to get rid of this problem have proven improper, however, lawmakers extensively neglect the issue [23]. Inaccurate use of information acquired from an untrusted resource to create an HTML web page, Use of verification information (cookie information) to demand permission, and also the absence of permission for vital procedure. The approximated prices consist of service disruption, denial of service (DoS), data theft or deletion, and also loss of credibility [24].

Discovering vulnerabilities is not an unlawful task, whereas manipulating vulnerabilities normally is. Inner researchers refer to those vulnerability researchers affiliated with a company that will comply with correct disclosure plans and also procedures to launch the vulnerability details to the supplier. Vulnerabilities enable undesirable accessibility to individual details. For example, the research evaluated some leading vulnerability finders, a lot of which recognize the importance of the gray and also black markets in vulnerabilities [25]. The need for cybersecurity showed up in the early years of the digital era when the initial mainframe computer systems were designed [26]. A lot of software application systems are possibly at risk of attacks also if there's rigorous adherence to leading-edge concepts of encryption and also decryption [27]. It is necessary to keep in mind that an attacker could act utilizing accredited or unapproved accessibility. Exterior attackers could present detailed protection hazards by utilizing unapproved remote accessibility (from exterior public networks) to the software application advancement setting items [28]. It's unanimously agreed that any type of and also every system worldwide can be cracked [29]. Technically, designers of software products can implement robust password-based or fingerprint authentication connectivity limitations in their programs. Nevertheless, doing so may negatively influence individuals from taking on the software application. Consequently, programmers may think twice to implement strong access control systems. Rather, they are more probable to supply numerous accessibility control choices (e.g., PIN code, password, biometric, and so on.) and also leave the choice to individuals while wishing that they'll pick the toughest feasible accessibility control. Nevertheless, no empirical proof recommends that individuals picked one of the safest and most secure access control choices. All vulnerabilities don't present the same threat. Vulnerabilities generally clearly stand for a significant cyber security problem [30]. Harmful data (code) can do the same, without the user's authorization or perhaps knowledge.

To inspire trainees to see cyber security as vital and also a prospective profession selection, undergraduate programs need to concentrate more on protection concerns [31]. The Human Protection KA is concentrated on shielding the individual information of people, and also it consists of identification administration, social design, and also personal privacy. The Software application Protection KA targets creating and also utilizing software application applications that protect the security properties of the information and also the systems they safeguard. The Social Protection KA covers elements of cybersecurity that can impact society and also it consists of cybercrime, cyber legislation, values, plan, intellectual property, specialist obligation, social obligation, and also social and also worldwide factors to consider [26]. Absence indicates supplying problems where accessibility to a solution (for instance, software application updates) or calls for details will not be offered to typical individuals [28]. A cautious analysis of the existing real personal privacy and also cybersecurity concerns and also the begged/supposed remedies provided by software application suppliers increase questions regarding vendors' guarantees [9]. A lot of cybersecurity programs seem to emphasize cybersecurity policy preparation, conformity audits, and also various other abilities [32]. A constant motif in literature was just how SMEs don't take cybersecurity issues seriously [33]. SMEs could additionally don't have an inner cybersecurity policy to decrease the opportunity of cyber-attacks [7]. Intellectual property (IP) theft and also espionage, provide extra expert hazards [19]. It's business procedures and also details, consisting of intellectual property that's the target of the attacker [34]. This absence of cybersecurity expertise is a significant issue in software application development [22]. The input/output design by Andrijcic and Horowitz simulates the economic consequences of stealing intellectual property on the state of the American economy. It incorporates a Santos and Haimes input/output design of the impact of terrorism on the U.S. national economy as well as a design of potential international sources of intellectual property theft [5]. Does not have in clarify just how hackers’ procedure expertise and/or consider systems. Our comprehending of specific and also social cognition, consisting of the faculties for processing details, using expertise, altering choices, and also making decisions, is significantly restricted within hacker communities [35].

Over the past few years, the relevance of defending intellectual property rights and other types of property rights against cyberattacks has significantly increased. Young, innovative businesses could be destroyed if they lose their intellectual assets to cyberattacks. Cybercrime has the potential to bankrupt even large corporations [36]. Numerous various other studies keep in mind that the resources of attacks are unidentified in a substantial portion of instances [12]. For example, a hack took place in Rye Brook, NY, by an Iranian team that took on a small dam in the area in 2013. The good news is, that the dam was down for upkeep at the moment however the Iranians acquired accessibility to the sluice gateway, enabling control of water ow leaving the dam. They acquired accessibility using the gateway via its system of sensing units which are connected to the web [19].

The Systematic Literature Review (SLR) technique has been used for the recognition of cybersecurity challenges/issues that are faced by vendor organizations during software development. Based on research questions, a pre-defined search string has been generated with help of which searching of relevant issued work is concluded in SLR. A pre-defined inclusion/exclusion method/criteria have been operated by SLR for the evaluation of collected data. A step-by-step approach has been used in the proposed SLR to recognize the challenges and practices of the Cyber Security Challenges Model. A total of thirteen (13) cybersecurity challenges have been identified by using the SLR approach as shown in Table 1.

Table 1

List of challenges identified through SLR
S.No	Challenges in CSCM	Frequency (N = 67)	Percentage of factors occurrence
1	Security Issues/Access of Cyber Attacks	39	58
2	Lack of Right Knowledge	32	48
3	Framework	32	48
4	Lack of Technical Support	29	43
5	Disaster Issues	27	40
6	Cost Security Issues	26	39
7	Lack of Confidentiality and Trust	25	37
8	Lack of Management	22	33
9	Unauthorized Access Issues	21	31
10	Lack of Resources	19	28
11	Lack of Metrics	19	28
12	Administrative Mistakes during Development	18	27
13	Lack of Quality, Liability, and Reliability	17	25

These critical challenges identified through SLR are “Security issues/Access of Cyberattacks”, “Lack of Right Knowledge”, “Framework”, “Lack of Technical Support”, “Disaster Issues”, “Cost Security issues”, “Lack of Confidentiality and Trust”, “Lack of Management”, “Unauthorized Access issues”, “Lack of Resources”, “Lack of Metrics”, “Administrative Mistakes during Development” and “Lack of Quality, Liability, and Reliability” as shown in Fig. 1.

The search process like trial search string have been used for paper selection such as Google Scholar, IEEE, SpringerLink, ACM, and Science Direct. We have finally selected 44 research articles and then by applying the snow bowling technique we have chosen 23 papers. In the last, a total of 67 research articles have been selected for the data extraction process.

For answering RQ1, we have conducted SLR, which is discussed in the above section. To combine the many strategies for the crucial cyber security issues that have been recognized, we have adhered to the SLR principles [37].

On a unique, previously created data extraction form, we gathered information from every single publication that was ultimately chosen. We eventually obtained 86 practices/solutions for attempting to avoid the stated cyber security risks encountered by supplier firms during software development after the data was synthesized and reviewed by the supervisor. The following practices are examples of how they might be used to the many recognized cyber security issues. In the following table of practices, we have used different abbreviations, which are:

“CSC” is used for “Critical Security Challenge/Cybersecurity Challenge”.
“PCSC” is used for “Practice for Critical Security Challenge”.
“P” is used for paper, as P-1 represents paper-1.

4.1. Practices to address the CSC – 1 “Security Issues/Access of cyber-attacks

In this section, we have discussed the recognized practices for CSC – 1, as cyber-attacks are numerously increasing and creating problems while developing software, so the following practices can be adopted to overcome these issues, as illustrated in Table 2.

Table 2

Practices for addressing “Security Issues/Access of Cyber-Attacks”
S. No
PCSC 1.1	To introduce the concept of open-source product development.	P-1, P-36	02
PCSC 1.2	To use the anti-malware protection system to keep the software safe.	P-3, P-18, P-36	03
PCSC 1.3	To understand and evaluate the current security practices, regulations, and standards.	P-7	01
PCSC 1.4	To advance vendor security concerns, the price of security be included in the product.	P-8	01
PCSC 1.5	To protect the individuals and organizations by applying Human and Organizational Security Knowledge Areas (KAs).	P-9	01
PCSC 1.6	To use the cryptographic concept for data sharing.	P-10, P-47, P-48	03
PCSC 1.7	To use Host Intrusion Detection Sensor (HID) mechanism for active defense.	P-14	01
PCSC 1.8	To use signature detection or multi-signature protection for privacy and security.	P-14, P-38	02
PCSC 1.9	To share in advance information about new threats and vulnerabilities for software protection.	P-16	01
PCSC 1.10	To create threat and vulnerability, warning model.	P-17	01
PCSC 1.11	To use defense-in-breadth approach for mitigating attacks.	P-19, P-32, P-37	03
PCSC 1.12	To use code reviews for finding and fixing of security bugs.	P-22	01
PCSC 1.13	To use twin strategies of detection and response, risk analysis and application performance degradation identifying and analyzing vulnerabilities of the software.	P-27, P-30, P-32	03
PCSC 1.14	To use strong passwords and two-factor authentication for safe use of software.	P-28, P-35	02
PCSC 1.15	To use anomaly detection method for detecting anomalous behaviors or data.	P-42	01

4.2. Practices for enhancing CSC – 2 "Lack of Right Knowledge"

In this Section, the practices for the above-mentioned challenge CSC – 2 have been described in Table 3, to deal with cyber security issues, the right knowledge of property rights and policies is necessary.

Table 3

Practices for addressing “Lack of Right Knowledge”
S. No	Practices
PCSC 2.1	To adopt and implement the strategies and technologies emerged from research activities for improvement in cybersecurity landscape.	P-5	01
PCSC 2.2	To share trend data about cyber incidents for effective strategic planning.	P-7	01
PCSC 2.3	To robust pipeline for cyber talent through different programs or academies.	P-11	01
PCSC 2.4	User awareness of cybersecurity and social responsibility to identify and handle threats properly.	P-13, P-14, P-18	03
PCSC 2.5	To enable ICT sector and government by sharing threat-based information to better protect critical systems.	P-7, P-16, P-61	03
PCSC 2.6	To reduce uncertainty, the collection of relevant historical data might have influence on software security.	P-24, P-65	02
PCSC 2.7	To replace former dyad protection techniques with a triad of cyber protection capabilities.	P-32	01
PCSC 2.8	To publish a set of guidelines for secure software development.	P-35	01

4.3. Practices to address CSC – 3 "Frameworks"

To Cope with the CSC – 3 “Frameworks”, where non-availability of protection for network computers, web browsers, and framework has been found, the following practices have been discovered and mentioned below in Table 4.

Table 4

Practices for addressing “Framework”
S. No
PCSC 3.1	To avoid potential targets of cyberstalking use Routine Activity Theory (RAT) framework.	P-3	01
PCSC 3.2	To create integrated, security aware software development environments.	P-5	01
PCSC 3.3	To use the four layers of protection cybersecurity strategy (preparedness, prevention, response and recovery).	P-19	01
PCSC 3.4	To use virtual computing machines approach for protecting software and networks.	P-32	01
PCSC 3.5	To apply up to date software security patches for protection of organizations networks systems.	P-8, P-35, P-36, P-59	04
PCSC 3.6	To adopt NIST cybersecurity framework for protection of data in transit.	P-48	01

4.4. Practices to address CSC – 4 "Lack of Technical Support"

The practices for the issues of lack of professional skills, training, and technical support are discussed in Table 5.

Table 5

Practices for addressing “Lack of Technical Support”
S. No	Practices	Paper IDs	Freq.
PCSC 4.1	To recognize the strategic importance of relationship between control systems and cybersecurity by professionals.	P-4	01
PCSC 4.2	To educate the professionals in multidisciplinary fields or sectors.	P-4, P-11	02
PCSC 4.3	To reconfigure Computer Science Courses to improve security in software development.	P-10	01
PCSC 4.4	Need of motivated and skilled cybersecurity professionals to prevent, detect, respond or mitigate the effect of threats.	P-20	01
PCSC 4.5	To develop critical thinking and problem-solving skills in addition to technical skills to asses, detect and identify threats.	P-16, P-17, P-20, P-63	04
PCSC 4.6	To use obfuscation technique to protect the software from attacks.	P-32	01

4.5. Practices for addressing CSC – 5 "Disaster Issues"

In this section, the practices to overcome the failure of protection, detection, and prevention of cyber-attacks/vulnerabilities and data manipulation which causes disasters are illustrated in Table 6.

Table 6

Practices for addressing “Disaster Issues”
S. No	Practices	Paper IDs	Freq.
PCSC 5.1	To minimize total losses, disclose vulnerabilities and release fixes quickly.	P-7	01
PCSC 5.2	To use Fair Information Practice Principles and other privacy and civil liberties policies, practices and frameworks for protection of privacy.	P-16	01
PCSC 5.3	To establish incident-response practices for most critical and significant cybersecurity incidents.	P-17	01
PCSC 5.4	To design compensating controls to mitigate threat likelihood and/or impact severity.	P-19	01
PCSC 5.5	To use deception techniques/strategies for tracking security incidents or distract attacker’s attention.	P-23, P-27	02
PCSC 5.6	To use auto-analysis of legitimate usage patterns for recognition of malicious activities.	P-48	01

4.6. Practices to enhance CSC – 6 "Cost Security Issues"

The practices for serious economic, investment, and financial challenges have been illustrated in Table 7.

Table 7

Practices for addressing “Cost Security Issues”
S. No	Practices	Paper IDs	Freq.
PCSC 6.1	To increase cost and use methods for empowering defenders to continue operation during an attack.	P-5	01
PCSC 6.2	To use monitoring cyber incidents and responses, soliciting and using standard terminology and measures for understanding cybersecurity economics.	P-7	01
PCSC 6.3	To maximize profit, the vendor needs to minimize expenditure on security.	P-8, P-49	02
PCSC 6.4	To use stock market returns to capture the direct and indirect costs of the information security breaches.	P-49	01
PCSC 6.5	To use cyber risk insurance policies as tool to provide coverage against losses/financial losses from internet related breaches.	P-57	01
PCSC 6.6	To understand effective IT governance prioritization and investment decision.	P-66	01

4.7. Practices for addressing CSC – 7"Lack of Confidentiality and Trust"

The practices for CSC – 7, where lack of trust, confidentiality, integrity, and intractability are found due to which it becomes more vulnerable to attacks, as discussed in Table 8.

Table 8

Practices for addressing “Lack of Confidentiality and Trust”
S. No	Practices	Paper IDs	Freq.
PCSC 7.1	To use cloud resources and artificial diversity technologies for protection.	P-5	01
PCSC 7.2	To use human-centricity approach to address the cybersecurity problem.	P-10	01
PCSC 7.3	To use prevention strategies to avoid information leakage, unauthorized access and modifications.	P-27	01
PCSC 7.4	To use a second threefold taxonomy for the protection of system.	P-37	01
PCSC 7.5	To use blockchain model to protect store information on computers.	P-38	01
PCSC 7.6	To protect the data of users on web browsers, it needs to be modified.	P-47	01
PCSC 7.7	To use data integrity verification method to save the data from tampering or being changed.	P-48	01

4.8. Practices to address CSC – 08 "Lack of Management"

In this section, the practices for the issues like lack of focus on requirements and protection from vulnerabilities during software development, management problems, careless and unconstrained behavior in development, and protection from vulnerabilities have been shown in Table 9.

Table 9

Practices for addressing “Lack of Management”
S. No	Practices	Paper IDs	Freq.
PCSC 8.1	To give controlling feedback of software to seller.	P-1	01
PCSC 8.2	To provide development and verification environment.	P-5	01
PCSC 8.3	To use human-centered and organizational development approaches for process of cybersecurity.	P-13	01
PCSC 8.4	To educate and train software managers for effective risk management.	P-16	01
PCSC 8.5	To create and share information by the employees in information management process.	P-25	01
PCSC 8.6	To create an atmosphere by the organizations that supports the development and maintenance of their expert staff.	P-53	01

4.9. Practices for addressing CSC – 9 "Unauthorized Access Issues"

The practices for the issues like access to information without authentication or any necessary process and lack of detection of the source of threats are discussed in Table 10.

Table 10

Practices for addressing “Unauthorized Access Issues”
S. No	Practices	Paper IDs	Freq.
PCSC 9.1	To act quickly by vendors in the context of inevitable vulnerability.	P-7	01
PCSC 9.2	To use intrusion detection system to detect and counter measure the unauthorized access to a network or computer system.	P-14, P-36, P-37, P-41, P-48, P-51, P-54	07
PCSC 9.3	To use devices only prepared by the ICT team and sealed for protection of data.	P-28	01
PCSC 9.4	To use perimeter defense strategy i.e., firewalls and antivirus software to protect against unauthorized access or unauthorized information flow of the system.	P-37, P-40, P-54, P-57	04
PCSC 9.5	To enforce access control mechanisms to user privileges and restrict unauthorized use of resources and data.	P-37	01
PCSC 9.6	To perform cybersecurity audit for the best protection of information.	P-42	01

4.10. Practices to enhance CSC – 10 "Lack of Resources"

In this section, the practices for the CSC – 10 have been discussed in Table 11, where the issues of lack of resources and the resources which are not used at the right time and place are found.

Table 11

Practices for addressing “Lack of Resources”
S. No	Practices	Paper IDs	Freq.
PCSC 10.1	To estimate resource and design more secure systems, software managers need cause and effect information.	P-7	01
PCSC 10.2	To choose effective measures and organizational structures for efficiently use of resources.	P-7	01
PCSC 10.3	To compete with malicious attackers in vulnerability market for the purchase of vulnerabilities for defensive purpose.	P-8	01
PCSC 10.4	To develop and fill needs of a knowledgeable, sophisticated cybersecurity workforce, non-traditional background applicants should be hired.	P-11, P-17	02
PCSC 10.5	To use security gadgets to detect criminal mails in effective way.	P-34	01

4.11. Practices for addressing CSC – 11 "Lack of Metrics"

The practices in connection with meaningful metrics, proactive cybersecurity measures, and lack of impact issues in software development are shown in Table 12.

Table 12

Practices for addressing “Lack of Metrics”
S. No	Practices	Paper IDs	Freq.
PCSC 11.1	To require some punishment mechanism to force the vendor be at stake when an attack occurs.	P-8	01
PCSC 11.2	To stipulate goals, milestones, and metrics to measure and communicate the extent of progress in addressing the issues.	P-16	01
PCSC 11.3	To create principled approach to cybersecurity to prevent, detect and recover from an incident.	P-16	01
PCSC 11.4	To support the generation of secure code, provide reliable measurements and metrics for helping decision makers in development of secure application.	P-24	01
PCSC 11.5	To keep measurable and monitored security in entire network for considering good design.	P-35	01
PCSC 11.6	To avoid cyberattacks and minimize their impacts, use detection traced through a host system calls.	P-51	01

4.12. Practices to address CSC – 12 "Administrative Mistakes during Development"

The practices for administrative mistakes/issues result in vulnerabilities and also in the loss of reputation of an organization illustrated in Table 13.

Table 13

Practices for Addressing “Administrative Mistakes During Development”
S. No	Practices	Paper IDs	Freq.
PCSC 12.1	To develop the capability to design, implement and evolve software and hardware systems which effectively manage risk, quality, cost and complexity.	P-5	01
PCSC 12.2	To create vulnerability market by using transferable security credits for balancing vulnerabilities in products.	P-7	01
PCSC 12.3	To create new tools for defense and hunt down hidden vulnerabilities in software and network through graduates.	P-11	01
PCSC 12.4	To increase security managers understandability by using surveillance.	P-27	01
PCSC 12.5	To use source code analysis for finding vulnerabilities at secure software development.	P-30	01
PCSC 12.6	To prevent virus infection by not sharing executable code with an infected source.	P-42	01
PCSC 12.7	To tend more care of data in traffic than stored data in software development.	P-47	01

4.13. Practices for addressing CSC-13 "Lack of Quality, Liability and Reliability"

The practices for Challenge CSC – 13, such as lack of quality, liability, and reliability during the development of software are discussed in Table 14.

Table 14

Practices for Addressing “Lack of Quality, Liability, And Reliability”
S. No	Practices	Paper IDs	Freq.
PCSC 13.1	To use carrot-and-stick-like strategy to prevent software from vulnerability exploitation.	P-8	01
PCSC 13.2	To use Department of Defense (DoD) Software and others standards approaches to develop overall quality software.	P-21	01
PCSC 13.3	To create a checklist type cybersecurity review for proper encryption and updation of the system.	P-59	01

Authors should discuss the results and how they can be interpreted from the perspective of previous studies and of the working hypotheses. The findings and their implications should be discussed in the broadest context possible. Future research directions may also be highlighted.

For awareness level challenges, the pairwise comparison matrix has been acquired by using Eq. 1 and the normalized matrix has been obtained by the usage of equations 3,4, and 5 as shown in Table 15, Tables 16 and 17. Where the value of λmax comes to 4.0526 is used for the high eigenvalue and CR = 0.0194, which is less than 0.10 and hence, satisfactory and acceptable.

Table 15

Important detail of SAATY basic 9 points scale
AHP/SAATY Scale	Linguistic Scale
1	Equivalent Value
3	Modest Significance
5	High Relevance
7	Immensely Important
9	Exceptional Relevance
2,4,6,8	Middle Ground Values

Table 16

Pairwise comparison for awareness level challenges
S.No	Challenge	CSC − 2	CSC − 3	CSC − 4	CSC − 11
1	CSC − 2	1.00	4.00	2.00	5.00
2	CSC − 3	0.25	1.00	0.50	3.00
3	CSC − 4	0.33	2.00	1.00	4.00
4	CSC − 11	0.20	0.33	0.25	1.00
	Sum	1.78	7.33	3.75	13.00

Table 17

Normalized matrix for awareness level challenges
S.No	Challenge	CSC − 2	CSC − 3	CSC − 4	CSC − 11	Criteria/Priority weights
1	CSC − 2	0.56	0.55	0.53	0.38	0.51
2	CSC − 3	0.14	0.14	0.13	0.23	0.16
3	CSC − 4	0.19	0.27	0.27	0.31	0.26
4	CSC − 11	0.11	0.05	0.07	0.08	0.08
λmax = 4.0526, CI = 0.0175, RI = 0.90, CR = 0.0194 < 0.1

In Tables 18 and 19, we have discussed the pairwise comparison matrix and normalized matrix for management level of challenges. As we can see below, the value of λmax = 3.02 and the value of CR = 0.0172 < 0.10, which means that the criteria rankings of the given issues are suitable and adequate. If the CR value is more than or equal to 0.1, the assessment procedure for improving consistency is recalled.

Table 18

Pairwise comparison for management level challenges
S.No	Challenge	CSC − 8	CSC − 10	CSC − 12
1	CSC − 8	1.00	0.25	0.50
2	CSC − 10	4.00	1.00	3.00
3	CSC − 12	2.00	0.33	1.00
	Sum	7.00	1.58	4.50

Table 19

Normalized matrix for management level challenges
S.No	Challenge	CSC − 8
1	CSC − 8	0.14	0.16	0.11	0.14
2	CSC − 10	0.57	0.63	0.67	0.62
3	CSC − 12	0.29	0.21	0.22	0.24
λmax = 3.02, CI = 0.01, RI = 0.58, CR = 0.0172 < 0.1

By applying the aforesaid equations, Tables 20 and 21 show the pairwise comparison and normalized matrix for the security level of challenges. Here, the λmax is equal to 4.1147 and the CR value is equal to 0.0424, which is again below 0.10 and hence, satisfactory and acceptable.

Table 20

Pairwise comparison for security level challenges
S.No	Challenge	CSC − 1	CSC − 5	CSC − 6	CSC − 9
1	CSC − 1	1.00	3.00	2.00	2.00
2	CSC − 5	0.33	1.00	0.33	0.33
3	CSC − 6	0.50	3.00	1.00	2.00
4	CSC − 9	0.50	3.00	0.50	1.00
	Sum	2.33	10.00	3.83	5.33

Table 21

Normalized matrix for security level challenges
S.No	Challenge	CSC − 1	CSC − 5	CSC − 6	CSC − 9	Criteria/Priority weights
1	CSC − 1	0.43	0.30	0.52	0.38	0.41
2	CSC − 5	0.14	0.10	0.09	0.06	0.10
3	CSC − 6	0.21	0.30	0.26	0.38	0.29
4	CSC − 9	0.21	0.30	0.13	0.19	0.21
λmax = 4.1147, CI = 0.0382, RI = 0.90, CR = 0.0424 < 0.1

A pairwise comparison matrix and normalized matrix for eminence level have been discussed in the given Tables 22 and 23, in which the value of λmax = 2.0376 and the value of CR = 0.0376, which is not more than 0.10, so the priority weights standard and agreeable.

Table 22

Pairwise comparison for eminence level challenges
S.No	Challenge	CSC − 7	CSC − 13
1	CSC − 7	1.00	0.25
2	CSC − 13	4.00	1.00
	Sum	5.00	1.25

Table 23

Normalized matrix for eminence level challenges
S.No	Challenge	CSC − 7	CSC − 13	Criteria/Priority Weights
1	CSC − 7	0.20	0.26	0.23
2	CSC − 13	0.60	0.80	0.70
λmax = 2.0376, CI = 0.0376, RI = 0.00, CR = 0.0376 < 0.1

While the pairwise comparison matrix and normalized matrix of these four levels of challenges are shown in Tables 24 and 25, in which the value of λmax = 4.2372 and CR = 0.087, which is beneath the value of 0.1, this shows that the priority weights of these stages of challenges are satisfactory and acceptable. We have deliberated the local and global weights of the challenges and their statuses of priority in detail in Table 26.

Table 24

Pairwise comparison between stages of challenges
S.No	Challenge	Awareness			Eminence
1	Awareness	1.00	3.00	2.00	2.00
2	Management	0.33	1.00	0.33	0.50
3	Security	0.50	3.00	1.00	4.00
4	Eminence	0.50	2.00	0.25	1.00
	Sum	2.33	9.00	3.58	7.50

Table 25

Normalized matrix for stages of challenges
S. No	Challenge	Awareness	Management	Security	Eminence	Criteria/Priority weights
1	Awareness	0.43	0.33	0.56	0.27	0.40
2	Management	0.14	0.11	0.09	0.07	0.10
3	Security	0.21	0.33	0.28	0.53	0.34
4	Eminence	0.21	0.22	0.07	0.13	0.16
λmax = 4.2372, CI = 0.079, RI = 0.90, CR = 0.087 < 0.1

Table 26

Summary of local and global weights of challenges and their statuses/ranks
Level	Weights	Challenges	Local Weights	Local Ranks	Global Weights	Global Ranks
Awareness	0.0194	Lack of Right Knowledge - CSC − 2	0.51	2	0.009894	5
		Framework - CSC − 3	0.16	3	0.003104	11
		Lack of Technical Support - CSC − 4	0.26	4	0.005044	8
		Lack of Metrics - CSC − 11	0.08	11	0.001552	13
Management	0.0172	Lack of Management - CSC − 8	0.14	8	0.002408	12
		Lack of Resources - CSC − 10	0.62	10	0.010664	4
		Administrative mistakes during Development - CSC − 12	0.24	12	0.004128	10
Security	0.0424	Security Issues/Access of Cyber Attacks - CSC − 1	0.41	1	0.017384	2
		Disaster Issues - CSC − 5	0.1	5	0.00424	9
		Cost Security Issues - CSC − 6	0.29	6	0.012296	3
		Unauthorized Access Issues – CSC − 9	0.21	9	0.008904	6
Eminence	0.0376	Lack of Confidentiality and Trust - CSC − 7	0.23	7	0.008648	7
Eminence	0.0376	Lack of Quality, Liability, and Reliability - CSC − 13	0.7	13	0.02632	1

The role of a particular challenge within the broad study has been explained by the global weights. The global weight of the challenge is the product of the local weights of the challenges and the weight of its related stage. Taking an example for CSC-1, the global weight is 0.017384, that’s attained by taking the product of 0.0424 and 0.41. The same has been identified for the remainder of the challenges too, which are demonstrated below. Amongst these 13 critical cybersecurity challenges, the uppermost global value has been taken by CSC-13 and CSC-11 has the lowest global rank, and except for these two, all other challenges have values between these two challenges. The list of prioritizing and statuses of these critical cybersecurity challenges is shown in Table 27.

Table 27

Prioritize the challenges
CSC#	Challenges	Priority
CSC – 1	Security Issues/Access of Cyber Attacks	2
CSC – 2	Lack of Right Knowledge	5
CSC – 3	Framework	11
CSC – 4	Lack of Technical Support	8
CSC – 5	Disaster Issues	9
CSC – 6	Cost Security Issues	3
CSC – 7	Lack of Confidentiality and Trust	7
CSC – 8	Lack of Management	12
CSC – 9	Unauthorized Access Issues	6
CSC – 10	Lack of Resources	4
CSC – 11	Lack of Metrics	13
CSC – 12	Administrative Mistakes during Development	10
CSC − 13	Lack of Quality, Liability, and Reliability	1

CSC-1 “Security Issues/Access of Cyber Attacks” has been prioritized as the 2nd most critical cybersecurity challenge for the cybersecurity challenges model, as it is also identified as the top most critical challenge by the SLR study, so vendors need to take significant action against this security challenge. We can also prioritize the recognized practices alongside each categorized challenge by applying the same method.

Table 1 lists the 13 issues that were recognized mainly with the support of SLR. These cybersecurity challenges are “Security issues/Access of Cyberattacks”, “Lack of Right Knowledge”, “Framework”, “Lack of Technical Support”, “Disaster Issues”, “Cost Security issues”, “Lack of Confidentiality and Trust”, “Lack of Management”, “Unauthorized Access issues”, “Lack of Resources”, “Lack of Metrics”, “Administrative Mistakes during Development”, and “Lack of Quality, Liability, and Reliability”. We have also recognized a total of 86 practices for these 13 critical cybersecurity challenges through SLR, which are discussed in Table 02 to Table 14.

Furthermore, we have categorized the recognized 13 critical cyber security challenges into four groups i.e., “Awareness”, “Management”, “Security”, and “Eminence”, which are shown in Table 24. After that, we applied Analytic Hierarchy Process (AHP) approach for prioritization of the identified critical challenges as discussed above. Through this technique we have been able to find the local and global rankings of each critical cyber security challenge, as discussed above in Table 26, and also found the global priority ranking of every identified cyber security challenge. We can also apply this approach to the identified practices. Our research aim is to provide protection way to the software vendors' organizations from cybersecurity issues in the terms of software development. In the future, we also want to apply the Fuzzy TOPSIS approach to these critical cybersecurity challenges and on its practices for prioritization and to distinguish the most important critical cybersecurity challenges among the classified ones.

A significant amount of research still needs to be done in this area, but authors who have already completed their studies in this field may have some discrepancies while submitting their reports, which became the primary reason why these cyber security issues adversely affected the companies of software vendors during software development. Furthermore, we have faced some difficulties in extracting the data from the papers from several well-known search engines, such as Google Scholar and will be conducted in the future.

Author Contributions: “Conceptualization, A.W.K. and S.Z.; methodology, A.W.K. and S.Z.; software, A.W.K. and S.Z; validation, A.W.K. and S.Z. and F.K.; formal analysis, J.K. and F.K; investigation, F.K and J.K.; resources A.W.K. Y.M.L and J.K; writing—original draft preparation, A.W.K. and S.Z; writing—review and editing, A.W.K., J.K, Y.M.L, and S.Z.; supervision, A.W.K.; project administration, A.W.K.; funding acquisition, Y.M.L.

Funding: This work was supported by the research fund of Hanyang University (HY-2021-0372, HY-2022-0010, HY-2023)

Informed Consent Statement: Not applicable.

Data Availability Statement: Not applicable.

Conflicts of Interest: The authors declare no conflict of interest.

Jang-Jaccard, J., Nepal, S.: A survey of emerging threats in cybersecurity. J. Comput. Syst. Sci. 80(5), 973–993 (2014)
Möller, D.P., Haas, R.E.: Automotive Cybersecurity. In: Guide to Automotive Connectivity and Cybersecurity, pp. 265–377. Springer (2019)
Kshetri, N.: Cybercrime and cybersecurity in India. In: Cybercrime and Cybersecurity in the Global South, pp. 101–118. Springer (2013)
Campbell, K., et al.: The economic cost of publicly announced information security breaches: empirical evidence from the stock market. J. Comput. Secur. 11(3), 431–448 (2003)
Rue, R., Pfleeger, S.L., Ortiz, D.: A Framework for Classifying and Comparing Models of Cyber Security Investment to Support Policy and Decision-Making. in WEIS. (2007)
Gal-Or, E., Ghose, A.: The economic incentives for sharing security information. Inform. Syst. Res. 16(2), 186–208 (2005)
Ogunjimi, O., Afolorunso, A., Olukomoro, O.:Elicitation of SME Requirements for Cybersecurity Solutions Through Adherence to Recommendations
Fuller, N.J., Simco, G.: Software and cybersecurity: Attack resistant secure software development survivable Distributed Communication Services (DCS). in 2008 IEEE Conference on Technologies for Homeland Security. IEEE. (2008)
Ruiz, R.A., Study of the UK Undergraduate Computer Science Curriculum: : A Vision of Cybersecurity. in 2019 IEEE 12th International Conference on Global Security, Safety and Sustainability (ICGS3). IEEE. (2019)
Ruiz, R., Winter, R., Amatte, F.: The leakage of passwords from home banking sites: A threat to global cyber security? J. Payments Strategy Syst. 11(2), 174–186 (2017)
Klaper, D., Hovy, E.: A taxonomy and a knowledge portal for cybersecurity. in Proceedings of the 15th annual international conference on digital government research. (2014)
Pfleeger, S.L., Rue, R.: Cybersecurity economic issues: Clearing the path to good practice. IEEE Softw. 25(1), 35–42 (2008)
Jahankhani, H., Al-Nemrat, A., Hosseinian-Far, A.: Cybercrime classification and characteristics, in Cyber Crime and Cyber Terrorism Investigator's Handbook, pp. 149–164. Elsevier (2014)
Nixon, J., McGuinness, B.: Framing the human dimension in cybersecurity. EAI Endorsed Transactions on Security and Safety. 1(2), e2 (2013)
Cavusoglu, H., Mishra, B., Raghunathan, S.: The effect of internet security breach announcements on market value: Capital market reactions for breached firms and internet security developers. Int. J. Electron. Commer. 9(1), 70–104 (2004)
Vagoun, T., Strawn, G.O.: Implementing the federal cybersecurity R&D strategy. Computer. 48(4), 45–55 (2015)
Khan, A.W., et al.: Analyzing and Evaluating Critical Cyber Security Challenges Faced by Vendor Organizations in Software Development: SLR Based Approach.IEEE Access, (2022)
Zaib, S., Khan, A.W., Qasim, I.: Cyber Security Challenges Model: SLR-Based Protocol and Initial Findings. Evolving Software Processes: Trends and Future Directions, : p. 253–270. (2022)
Auffret, J.-P., et al.: Cybersecurity leadership: Competencies, governance, and technologies for industrial control systems. J. Interconnect. Networks. 17(01), 1740001 (2017)
Hund, R.L.: Acquisition Regulations and Offshore Software Development: Implications for Cybersecurity of DOD Networks. Air War College Air University Maxwell AFB United States (2013)
Borky, J.M., Bradley, T.H.: Protecting information with cybersecurity, in Effective Model-Based Systems Engineering. Springer. p. 345–404. (2019)
Buckley, I.A., Zalewski, J., Clarke, P.J.: Introducing a cybersecurity mindset into software engineering undergraduate courses. Int. J. Adv. Comput. Sci. Appl. 9(6), 448–452 (2018)
Gehring, D.I.R.A.: Software development, intellectual property rights, and IT security. Berlin. (2002)
Schneidewind, N.: Metrics for mitigating cybersecurity threats to networks. IEEE Internet Comput. 14(1), 64–71 (2009)
Li, Z., Liao, Q.: An economic alternative to improve cybersecurity of e-government and smart cities. in Proceedings of the 17th international digital government research conference on digital government research. (2016)
Cabaj, K., et al.: Cybersecurity education: Evolution of the discipline and analysis of master programs. Computers & Security. 75, 24–35 (2018)
Rastogi, A. and K.E. Nygard. Cybersecurity practices from a software engineering perspective.in Proceedings of the International Conference on Software Engineering Research and Practice (SERP). 2017. The Steering Committee of The World Congress in Computer Science,Computer &#8230
Barabanov, A.V., et al.: Current taxonomy of information security threats in software development life cycle. in 2018 IEEE 12th International Conference on Application of Information and Communication Technologies (AICT). IEEE. (2018)
Ayofe, A.N.: Oluwaseyifunmitan, towards ameliorating cybercrime and cybersecurity. Int. J. Comput. Sci. Inform. Secur. 3(1), 1–11 (2009)
Sen, R.: Challenges to cybersecurity: Current state of affairs. Commun. Association Inform. Syst. 43(1), 2 (2018)
McGettrick, A.: Toward effective cybersecurity education. IEEE Secur. Priv. 11(6), 66–68 (2013)
Crumpler, W., Lewis, J.A.: The cybersecurity workforce gap. Center for Strategic and International Studies (CSIS), Washington, DC, USA (2019)
Kabanda, S., Tanner, M., Kent, C.: Exploring SME cybersecurity practices in developing countries. J. Organizational Comput. Electron. Commer. 28(3), 269–282 (2018)
Tisdale, S.M.: Cybersecurity: Challenges from a Systems, Complexity, Knowledge Management and Business Intelligence Perspective.Issues in Information Systems, 16(3). (2015)
Summers, T., et al.: How hackers think: A study of cybersecurity experts and their mental models. in Third Annual International Conference on Engaged Management Scholarship, Atlanta, Georgia. (2013)
Srinidhi, B., Yan, J., Tayi, G.K.: Allocation of resources to cyber-security: The effect of misalignment of interest between managers and investors. Decis. Support Syst. 75, 49–62 (2015)
Kitchenham, B., Charters, S.: Guidelines for performing systematic literature reviews in software engineering. (2007)
Akram, M., Al-Kenani, A.N., Alcantud, J.C.R.: Group decision-making based on the VIKOR method with trapezoidal bipolar fuzzy information. Symmetry. 11(10), 1313 (2019)
Chatterjee, P., Chakraborty, S.: A comparative analysis of VIKOR method and its variants. Decis. Sci. Lett. 5(4), 469–486 (2016)
Angitha, A.: and M. Supriya, ranking of educational institutions based on user priorities using AHP-PROMETHEE approach, in Advances in Computing and Network Communications, pp. 127–142. Springer (2021)
Xu, C.: Using AHP-entropy approach to investigate the key factors on FinTech service. J. Comput. 32(1), 200–211 (2021)
Akbar, M.A., et al.: Requirement change management challenges in GSD: An analytical hierarchy process approach. J. Software: Evol. Process. 32(7), e2246 (2020)
Zarbakhshnia, N., et al.: A novel hybrid multiple attribute decision-making approach for outsourcing sustainable reverse logistics. J. Clean. Prod. 242, 118461 (2020)
Shameem, M., et al.: Analytic hierarchy process-based prioritisation and taxonomy of success factors for scaling agile methods in global software development. IET Softw. 14(4), 389–401 (2020)
Wieland, G., Zeiner, H.: A Survey on criteria for smart home systems with integration into the analytic hierarchy process. in International Conference on Decision Support System Technology. Springer. (2021)

No competing interests reported.

Identification and Prioritization of Critical Cyber Security Challenges and Practices for Software Vendor Organizations in Software Development: An AHP-Based Systematic Approach

Status:

Version 1

Abstract

Figures

1. Introduction

2. Related Work

3. Methodology

4. Practices Identified Through Slr For Addressing The Recognized Critical Cyber Security Challenges