Wouter Joosen

The growing need for integrating security through out the software development lifecycle leads to the adoption of various security activities. Threat modeling is widely recognized as a process that helps assess security issues, especially architectural flaws, due to insecure design, thereby supporting the security-by-design mindset. While many research and industry sources advocate for threat modeling, others highlight issues such as the lack of motivation, its time-consuming nature, and practical difficulties, leading to questions about its overall effectiveness. In this study, we conduct a comprehensive multivocal literature review to systematically examine the empirical evidence for the effectiveness of threat modeling. In short, by analyzing 109 sources from both white and gray literature, we did not encounter any direct, causal evidence (e.g., a controlled experiment) for the effectiveness of threat modeling as a technique to improve the security of a software application. This absence of causal evidence should not be interpreted as evidence that threat modeling is ineffective, though. The existing literature does describe several benefits and challenges related to threat modeling, as well as suggestions for improving the effectiveness of threat modeling activities. Studies on threat modeling often concentrate on benefits such as improved performance, effectiveness, efficiency, and usability of specific tools and methods. Recurring challenges, on the other hand, include a perceived lack of benefits, tool limitations, usability issues, and difficulties integrating threat modeling into the secure software development lifecycle. Suggestions for improvements include providing clear checklists or guidance, defining a clear scope, and involving different stakeholders during threat modeling activities. Based on this review of the literature, researchers are invited to conduct rigorous empirical studies to address the underexplored aspects of threat modeling, thereby strengthening its evidence base and increasing its impact in the real world.

This paper presents how an existing framework for offline performance optimization can be applied to microservice applications during the Release phase of the DevOps life cycle. Optimization of resource allocation configuration parameters for CPU and memory during the Release phase remains a largely unexplored problem as most research has focused on intelligent scheduling and autoscaling of microservices during the Ops stage of the DevOps cycle. Yet horizontal auto-scaling of containers, based on CPU usage for instance, may still leave these containers with an inappropriately allocated amount of memory, if no upfront fine-tuning of both resources is applied before the Deployment phase. We evaluate the performance optimization framework using the TeaStore microservice application and statistically compare different optimization algorithms, supporting informed decisions about their trade-offs between sampling cost and distance to the optimal resource configuration. This shows that upfront factor screening, for reducing the search space, is helpful when the goal is to find the optimal resource configuration with an affordable sampling budget. When the goal is to statistically compare different algorithms, screening must also be applied to make data collection of all data points in the search space feasible. If the goal is to find a near-optimal configuration, however, it is better to run bayesian optimization without screening.

The trend to support healthcare outside of the premises and control of health institutions has given rise to a diversity of devices (e.g. wearables), services, and players contributing to the ecosystem. In consequence, health-related and medical data are frequently dispersed across multiple institutions and devices, posing a significant challenge to comprehensive data analysis and exploration for AI-driven research on new medicines or treatments. Centralizing such sensitive data is often unachievable due to the rigorous security and privacy demands imposed by various stakeholders, including patients, general practitioners, and pharmaceutical researchers. The decentralized and dispersed nature of healthcare data, in combination with stringent regulatory constraints such as HIPAA and GDPR, necessitate innovative approaches to collaborative healthcare research. Federated learning is a promising class of solutions to harness the collective intelligence of diverse datasets by allowing collaborative model training across decentralized data sources. Despite the many privacy-enhancing techniques proposed to ensure the confidentiality of data and intellectual property, this chapter discusses and illustrates the challenges of leveraging shared representations and knowledge transfer between smart health applications while addressing the intricacies of data fragmentation, security, and privacy.