Where academic tradition
meets the exciting future

You are here: TUCS > PUBLICATIONS > Publication Search > Securing Scrum for VAHTI

Securing Scrum for VAHTI

Kalle Rindell, Sami Hyrynsalmi, Ville Leppänen, Securing Scrum for VAHTI. In: Jyrki Nummenmaa, Outi Sievi-Korte, Erkki Mäkinen (Eds.), Proceedings of the 14th Symposium on Programming Languages and Software Tools, 236–250, University of Tampere, School of Information Sciences, 2015.

Abstract:

Software security is a combination of security methods, techniques and tools, aiming to promote data confidentiality, integrity, usability, availability and privacy. In order to achieve concrete and measurable levels of software security, several international, national and industry-level regulations have been established. Finnish governmental security standard collection, VAHTI, is one of the most extensive example of these standards. This paper presents a selection of methods, tools, techniques and modifications to Scrum software development method to achieve the levels of security compliant with VAHTI instructions for software development. These comprise of security-specific modifications and additions to Scrum roles, modifications to sprints, and inclusion of special hardening sprints and spikes to implement the security items in the product backlog. Security requirements are transformed to security stories, abuse cases and other security-related tasks. Definition of done regarding the VAHTI requirements on is established and the steps to achieve it are described.

Files:

Full publication in PDF-format

BibTeX entry:

@INPROCEEDINGS{inpRiHyLe15a,
  title = {Securing Scrum for VAHTI},
  booktitle = {Proceedings of the 14th Symposium on Programming Languages and Software Tools},
  author = {Rindell, Kalle and Hyrynsalmi, Sami and Leppänen, Ville},
  editor = {Nummenmaa, Jyrki and Sievi-Korte, Outi and Mäkinen, Erkki},
  publisher = {University of Tampere, School of Information Sciences},
  pages = {236–250},
  year = {2015},
  keywords = {Scrum, agile, VAHTI, software security, security standards},
}

Belongs to TUCS Research Unit(s): Software Development Laboratory (SwDev)

Publication Forum rating of this publication: level 1

Edit publication