170 citations · 564 across the 17 of their papers we have counts for
5 papers · 1 filter
Open or Sneaky? Fast or Slow? Light or Heavy?: Investigating Security Releases of Open Source Packages
Nasif Imtiaz, Aniqa Khanom, Laurie Williams
Vulnerabilities in open source packages can be a security risk for the client projects that use these packages as dependencies. When a new vulnerability is discovered in a package,…
What are Weak Links in the npm Supply Chain?
Nusrat Zahan, Thomas Zimmermann, Patrice Godefroid +3
Modern software development frequently uses third-party packages, raising the concern of supply chain security attacks. Many attackers target popular package managers, like npm, an…
A Comparative Study of Vulnerability Reporting by Software Composition Analysis Tools
Nasif Imtiaz, Seaver Thorne, Laurie Williams
Background: Modern software uses many third-party libraries and frameworks as dependencies. Known vulnerabilities in these dependencies are a potential security risk. Software comp…
Memory Error Detection in Security Testing
Nasif Imtiaz, Laurie Williams
We study 10 C/C++ projects that have been using a static analysis security testing tool. We analyze the historical scan reports generated by the tool and study how frequently memor…
Structuring a Comprehensive Software Security Course Around the OWASP Application Security Verification Standard
Sarah Elder, Nusrat Zahan, Val Kozarev +3
Lack of security expertise among software practitioners is a problem with many implications. First, there is a deficit of security professionals to meet current needs. Additionally…