Security is one of the most critical aspects of software quality. Software security refers to the process of creating and developing software that assures the integrity, confidentiality, and availability of its code, data, and services. Software development organizations treat security as an afterthought issue, and as a result, they continue to face security threats. Incorporating security at any level of the Software Development Life Cycle (SDLC) has become an urgent requirement. Several methodologies, strategies, and models have been proposed and developed to address software security, but only a few of them give reliable evidence for creating secure software applications. Software security issues, on the other hand, have not been adequately addressed, and integrating security procedures into the SDLC remains a challenge. The major purpose of this paper is to learn about software security risks and practices so that secure software development methods can be better designed. A systematic literature review (SLR) was performed to classify important studies to achieve this goal. Based on the inclusion, exclusion, and quality assessment criteria, a total of 121 studies were chosen. This study identified 145 security risks and 424 best practices that help software development organizations to manage the security in each phase of the SDLC. To pursue secure SDLC, this study prescribed different security activities, which should be followed in each phase of the SDLC. Successful integration of these activities minimizing effort, time, and budget while delivering secure software applications. The findings of this study assist software development organizations in improving the security level of their software products and also enhancing their security efficiency. This will raise the developer’s awareness of secure development practices as well.

In the modern digital era, software systems are extensively adapted and have become an integral component of human society. Such wide use of software systems consists of large and more critical data that inevitably needs to be secured. It is imperative to make sure that these software systems not only satisfy the users' needs or functional requirements, but it is equally important to make sure the security of these software systems. However, recent research shows that many software development methods do not explicitly include software security measures during software development as they move from demand engineering to their final losses. Integrating software security at each stage of the software development life cycle (SDLC) has become an urgent need. Tackling software security, various methods, techniques, and models have been suggested and developed, however, only a few of them provide strong evidence for building secure software applications. The main purpose of this research is to study security measures in the context of the development of secure software (SSD) during the study of systematic mapping (SMS). Based on the inclusion and exclusion criteria, 116 studies were selected. After the data extraction from the selected 116 papers, these were classified based on the quality assessment, software security method, SDLC phases, publication venue, and SWOT analysis. The results indicate that this domain is still immature and sufficient research work needs to be carried out particularly on empirically evaluated solutions.

Offshore software development outsourcing (OSDO) is a modern business strategy for producing high-quality software at a low cost. The OSDO refers to the practice of contracting to an offshore (extrinsic) organization to perform some or all software development work of a product. For the benefit of the OSDO vendors, this paper aims to develop a “communication and coordination challenges mitigation model” (CCCMM) that provides solutions for unambiguously defined communication and coordination processes in global software development (GSD) environment. Our proposed model is based on the fuzzy multi-attribute decision-making (FMADM) approach incorporating the capability of group decision-making. The FMADM approach is used both in the ranking of survey and assessment of case studies. First, the authors undertook a systematic literature review (SLR) that identified all cited challenges from a set of 101 articles. We identified 18 problem areas faced by the GSD vendors in OSDO relationships. Of these, six were ranked as critical. For the purpose of identifying corrective interventions, a second SLR was conducted that revealed 75 remedial measures extracted from 63 chosen articles. To validate our SLR findings, we surveyed 42 outsourcing experts from six countries. We also categorized six critical challenges and 75 corrective practices into four mitigation levels based on CMMI, SOVRM, and SOPM. In addition, two case studies were conducted to evaluate CCCMM outcomes in OSDO companies. The assessment results of the first case study do not recommend Company-A for the successful implementation of level-2 of the CCCMM, so Company-A stands at level-1. We have observed from the second case study that Company-B has implemented all the critical challenges of the level-2 only; therefore, Company-B is at level-2 “success” of the proposed assessment model.

The number of security attacks and the impact has grown considerably in the recent several years. As a result, new emerging software development models are required that assist in developing software that is secure by default. This article reviews the most widely used security software models. It proposes a new Security Assurance Model (SAM) for Software Development that is adaptable to all contemporary scenarios, emphasizing global software development (GSD) vendor companies. The SAM of Software Development was developed after studying 11 well-known development models and analyzing results obtained from a systematic literature review (SLR) and questionnaire survey. The SAM of Software Development consists of seven security assurance levels: Governance and Security Threat Analysis, Secure Requirement Analysis, Secure Design, Secure Coding, Secure Testing and Review, Secure Deployment, and Security Improvement. The security assurance levels of SAM of software development consist of 46 critical software security risks (CSSRs) and 388 practices for addressing these risks. The proposed SAM of Software Development was assessed based on a tool created by Motorola, which is used to evaluate the present state of a company’s software processes and find areas for improvement. We conducted 3 case studies on software development companies, using data from real software projects to examine the results of a practical experiment in each company. The results of the case studies indicate that the proposed SAM of Software Development helps measure the security assurance level of an organization. In addition, it can potentially serve as a framework for researchers to develop new software security measures.

Generative AI (GAI) is one of the significant components that can efficiently improve and augment the AI cycle model’s robustness when it comes to different threats, weaknesses, and abnormalities detection. When applied in this field, GAI is very useful in emulating the various forms of security violations in actual adversarial settings. These scenarios are important when different aspects of an AI system are tested on how robust they are and thus permit the developers to amend any vulnerability that may be induced before the time it could be utilized in practice. Data and model manipulation, data theft, and adversarial attacks as well as model inference threats which we do a systematic analysis to disrupt the integrity, confidentiality as well as availability of AI models. Considering the current weaknesses and threats related to GAI we provide a systematic approach to how safety concerns that are currently relevant can be integrated with every stage of Artificial Intelligence (AI) lifecycle management: from continuous monitoring to the application of cybersecurity trends and practices, etc. In our approach, the emphasis is placed on the multi-level security management strategy that incorporates the improvement of coding practices, validation and testing, and the implementation of advanced intrusion detection systems. Before proceeding to further analysis and discussion of the given topic, it is also critical to mention the aspect of regulation and ethical concern as the major drivers of GAI usage. Additionally, organizations can involve GAI in the lifecycle to address security needs, during the development, acquisition, deployment, updating, maintenance, and decommissioning of the AI system, making them reliable, safe, and secure all through their lifecycle. Toward these ends, the goal of this work is to present a set of canonical recommendations for the many scientists, engineers, managers, technologists, and policymakers who will play a key role in constructing a sound and secure AI future.

With the increasing reliance on software applications, cybersecurity threats have become a critical concern for developers and organizations. The answer to this vulnerability is AI systems, which help us adapt a little better, as traditional measures in security have failed to respond to the upcoming threats. This paper presents an innovative cybersecurity framework using AI, by the Artificial Neural Network (ANN)—Interpretive Structural Modeling (ISM) model, to improve threat detection, vulnerability assessment, and risk response during software development. This framework helps realize dynamic, intelligent security as a part of the Software Development life cycle (SDLC). Initially, existing cybersecurity risks in software coding are systematically evaluated to identify potential gaps and integrate best practices into the proposed model. In the second phase, an empirical survey was conducted to identify and validate the findings of the systematic literature review (SLR). In the third phase, a hybrid approach is employed, integrating ANN for real-time threat detection and risk assessment. It utilizes ISM to analyze the relationships between cybersecurity risks and vulnerabilities, creating a structured framework for understanding interdependencies. A case study was conducted in the last stage to test and evaluate the AI-driven cybersecurity Mitigation Model for Secure Software Coding. A multi-level categorization system is also used to assess maturity across five key levels: Ad hoc, Planned, Standardized, Metrics-Driven, and Continuous Improvements. This study identifies 15 cybersecurity risks and vulnerabilities in software coding, along with 158 AI-driven best practices for mitigating these risks. It also identifies critical areas of insecure coding practices and develops a scalable model to address cybersecurity risks across different maturity levels. The results show that AI outperforms traditional systems in detecting security weaknesses and simultaneously fixing problems. During Levels 1–3 of the system improvement process, advanced security methods are used to protect against threats. Our analysis reveals that organizations at Levels 4 and 5 still need to entirely shift to using AI-based protection tools and techniques. The proposed system provides developers and managers with valuable insights, enabling them to select security enhancements tailored to their organization's development stages. It supports automated threat analysis, helping organizations stay vigilant against potential cybersecurity threats. The study introduces a novel ANN-ISM framework integrating AI tools with cybersecurity modeling formalisms. By merging AI systems with secure software coding principles, this research enhances the connection between AI-generated insights and real-world cybersecurity usage.