Criteria Prioritization in Adaptive Security Activities Selection, ASAS Model using Analytic Network Process, ANP

Organizations have proposed the best practices of security activities in software development life cycle as guidance for development team. However, the implementation of the security activities are influenced by criteria which are interdependent to each other and dynamic. Those criteria are experience, skill and knowledge; teams workload; development team size; development timeline; and cost/budget. Therefore, the selection of security activities must be based on the priority of the criteria and adaptive. This paper addresses the adaptive security activities selection model as a multi-criteria decision making (MCDM) issue. Analytic Network Process (ANP) is proposed for weight calculation and criteria prioritization. Hypothetical examples were presented based on hard constraints faced by in-house web-based application development team in two different scenarios. The Decision Maker made the judgement by using the online ASAS model. The results show that experience, skill and knowledge get the highest priority in the first scenario while budget/ cost get the highest priority in the second scenario. These prioritization will be used as a major requirement in security activities selection.