VeriDevOps: Automated Protection and Prevention to Meet Security Requirements in Devops
Andrey Sadovykh1,6,a, Gunnar Widforss2,a, Dragos Truscan3, Eduard Paul Enoiu2,b, Wissam Mallouli4, Rosa Iglesias5, Alessandra Bagnto1 and Olga Hendel2,c
1Softeam, France
aandrey.sadovykh@softeam.fr
balessandra.bagnato@softeam.fr
2Mälardalen University, Sweden
agunnar.widforss@mdh.se
beduard.paul.enoiu@mdh.se
colga.hendel@mdh.se
3Åbo Akademi University, Finland
dragos.truscan@abo.fi
4Montimage EURL, France
wissam.mallouli@montimage.com
5Ikerlan Technology Research Centre, Basque Research and Technology Alliance (BRTA), Spain
riglesias@ikerlan.es
6Innopolis University, Russia
a.sadovykh@innopolis.ru
ABSTRACT
Current software development practices are increasingly based on using both COTS and legacy components which make such systems prone to security vulnerabilities. The modern practice addressing ever changing conditions, DevOps, promotes frequent software deliveries, however, verification methods artifacts should be updated in a timely fashion to cope with the pace of the process. VeriDevOps, Horizon 2020 project, aims at providing a faster feedback loop for verifying the security requirements and other quality attributes of large scale cyber-physical systems. VeriDevOps focuses on optimizing the security verification activities, by automatically creating verifiable models directly from security requirements formulated in natural language, using these models to check security properties on design models and then generating artefacts such as, tests or monitors that can be used later in the DevOps process. The main drivers for these advances are: Natural Language Processing, a combined formal verification and model-based testing approach, and machine-learning-based security monitors. VeriDevOps is in its initial stage - the project started on 1.10.2020 and it will run for three years. In this paper we will present the major conceptual ideas behind the project approach as well as the organizational settings.
Keywords: Model-Driven Engineering, Cybersecurity, Security-by-design, Prevention and Reaction, Requirement, Design checking, Testing and validation, Runtime Analysis, Root cause analysis, Natural Language Processing, Machine Learning.
