2013/09/06 by Randy Heiland, Heiland, Randy, Betsy Thomas +5
Business, Management and Accounting · Computer Science · Decision Sciences · #Big Data and Business Intelligence #Cryptography and Security (cs.CR) #Data Quality and Management #FOS: Computer and information sciences #Scientific Computing and Data Management #Software Engineering (cs.SE) #cs.CR #cs.SE
paper · pdf · doi:10.48550/arxiv.1309.1677
Submission to Workshop on Sustainable Software for Science: Practice and Experiences: http://wssspe.researchcomputing.org.uk/
arxiv created 2013/09/06 · openalex publication_date 2013/09/06 · arxiv updated 2013/09/09 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
In its Vision and Strategy for Software for Science, Engineering, and Education the NSF states that it will invest in activities that: "Recognize that software strategies must include the secure and reliable deployment and operation of services, for example by campuses or national facilities or industry, where identity, authentication, authorization and assurance are crucial operational capabilities." and "Result in high-quality, usable, secure, vulnerability-free, sustainable, robust, well-tested, and maintainable/evolvable software; and which promotes the sustainability of solid and useful on-going investments." Such statements evidence that security should indeed be a first-class consideration of the software ecosystem. In this position paper, we share some thoughts related to research software security. Our thoughts are based on the observation that security is not a binary, all-or-nothing attribute, but a range of practices and requirements depending on how the software is expected to be deployed and used. We propose that the community leverage the concept of a maturity model, and work to agree on a research software security maturity model. This model would categorize different sets of security needs of the deployment community, and provide software developers a roadmap for advancing the security maturity of their software. The intent of this paper is not to express such a comprehensive maturity model, but instead to start a conversation and set some initial requirements.