| Vol-1977 urn:nbn:de:0074-1977-5 Copyright © 2017 for the individual papers by the papers' authors. Copying permitted for private and academic purposes. This volume is published and copyrighted by its editors.

# SecSE 2017
Secure Software Engineering in DevOps and Agile Development

### Proceedings of the International Workshop on Secure Software Engineering in DevOps and Agile Development
co-located with the 22nd European Symposium on Research in Computer Security (ESORICS 2017)

### Oslo, Norway, September 14, 2017.

Edited by

### Martin Gilje Jaatun *
Daniela Soares Cruzes *

* Department of Software Engineering, Safety and Security, SINTEF Digital, NO-7465 Trondheim, Norway

## Table of Contents

- Preface

### Session 1

- Research Challenges in Empowering Agile Teams with Security Knowledge Based on Public and Private Information Sources 1-7
  Michael Felderer, Irdin Pekaric
- Comparing Capability of Static Analysis Tools to Detect Security Weaknesses in Mobile Applications 8-18
  Tosin Daniel Oyetoyan, Marcos Lordello Chaim

### Session 2

- Teaching Secure Software Development Through an Online Course 19-33
  Christopher Theisen, Ted Zhu, Kevin Oliver, Laurie Williams
- Managing Security Work in Scrum: Tensions and Challenges 34-49
  Sven Türpe, Andreas Poller
- SLA-Based Continuous Security Assurance in Multi-Cloud DevOps 50-68
  Erkuden Rios, Massimiliano Rak, Eider Iturbe, Wissam Mallouli
- SECBENCH: A Database of Real Security Vulnerabilities 69-85
  Sofia Reis, Rui Abreu

### Abstracts of Keynotes and Invited Talks

- Experiences with Continuous Deployment and Software Security in Google, Netflix, Facebook and others (abstract) 86
  Laurie Williams

2017-10-31: submitted by Martin Gilje Jaatun, metadata incl. bibliographic data published under Creative Commons CC0
2017-10-31: published on CEUR-WS.org |valid HTML5|