86 citations · 116 across the 10 of their papers we have counts for
10 papers
Assumptions to Evidence: Evaluating Security Practices Adoption and Their Impact on Outcomes in the npm Ecosystem
Nusrat Zahan, Imranur Rahman, Laurie Williams
Practitioners often struggle with the overwhelming number of security practices outlined in cybersecurity frameworks for risk mitigation. Given the limited budget, time, and resour…
S3C2 Summit 2023-11: Industry Secure Supply Chain Summit
Nusrat Zahan, Yasemin Acar, Michel Cukier +5
Cyber attacks leveraging or targeting the software supply chain, such as the SolarWinds and the Log4j incidents, affected thousands of businesses and their customers, drawing atten…
How Quickly Do Development Teams Update Their Vulnerable Dependencies?
Imranur Rahman, Ranindya Paramitha, Nusrat Zahan +2
Industry practitioners are increasingly concerned with software that contains vulnerable versions of third-party dependencies that are included both directly and transitively. To a…
Leveraging Large Language Models to Detect npm Malicious Packages
Nusrat Zahan, Philipp Burckhardt, Mikola Lysenko +2
Existing malicious code detection techniques demand the integration of multiple tools to detect different malware patterns, often suffering from high misclassification rates. There…
Comparing Effectiveness and Efficiency of Interactive Application Security Testing (IAST) and Runtime Application Self-Protection (RASP) Tools in a Large Java-based System
Aishwarya Seth, Saikath Bhattacharya, Sarah Elder +2
Security resources are scarce, and practitioners need guidance in the effective and efficient usage of techniques and tools available in the cybersecurity industry. Two emerging to…
Do Software Security Practices Yield Fewer Vulnerabilities?
Nusrat Zahan, Shohanuzzaman Shohan, Dan Harris +1
Due to the ever-increasing security breaches, practitioners are motivated to produce more secure software. In the United States, the White House Office released a memorandum on Exe…
Do I really need all this work to find vulnerabilities? An empirical case study comparing vulnerability detection techniques on a Java application
Sarah Elder, Nusrat Zahan, Rui Shu +4
CONTEXT: Applying vulnerability detection techniques is one of many tasks using the limited resources of a software project. OBJECTIVE: The goal of this research is to assist manag…
OpenSSF Scorecard: On the Path Toward Ecosystem-wide Automated Security Metrics
Nusrat Zahan, Parth Kanakiya, Brian Hambleton +2
The OpenSSF Scorecard project is an automated tool to monitor the security health of open-source software. This study evaluates the applicability of the Scorecard tool and compares…
What are Weak Links in the npm Supply Chain?
Nusrat Zahan, Thomas Zimmermann, Patrice Godefroid +3
Modern software development frequently uses third-party packages, raising the concern of supply chain security attacks. Many attackers target popular package managers, like npm, an…
Structuring a Comprehensive Software Security Course Around the OWASP Application Security Verification Standard
Sarah Elder, Nusrat Zahan, Val Kozarev +3
Lack of security expertise among software practitioners is a problem with many implications. First, there is a deficit of security professionals to meet current needs. Additionally…