Context and motivation

Software-based systems permeate the very fabric of our society -- from enterprise IT systems and mobile devices to smart home and city environments. Consequently, computer security is becoming an increasingly inter-disciplinary subject requiring attention to the various aspects of securing our software-based infrastructure. One must pay careful attention to ensure compatibility with existing software and the wider socio-technical context (e.g., users and organisations) which it inhabits. This, in turn, requires an approach that integrates insights from computer security research with rigorous software engineering methods to ensure the security and resilience of our digital infrastructure. ESSoS therefore welcomes contributions that are at the border of system security and software engineering.

Goal and setup

The goal of this symposium is to bring together researchers and practitioners to advance the state of the art and practice in secure software engineering. Being one of the few conference-level events dedicated to this topic, it explicitly aims to bridge the software engineering and software security communities. The symposium features two days of technical program including two keynote presentations. In addition to academic papers, the symposium encourages submission of high-quality, informative industrial experience papers about successes and failures in secure software engineering and the lessons learned. Furthermore, the symposium also accepts short idea papers that crisply describe a promising direction, approach, or insight.

Topics

            The Symposium seeks submissions on subjects related to its goals. This includes a diversity of topics including (but not limited to):
            Secure software engineering
            -Security by design
            - Empirical secure software engineering
            - Security-oriented software reconfiguration and evolution
            - Processes for the development of secure software and systems
            - Security testing
            - Security requirements analysis and modelling
            - Model checking for security
            Secure programming
            - Programming paradigms, models, and domain-specific languages for security
            - Verification techniques for security properties
            - Static and dynamic code analysis for security
            - Program rewriting techniques for security
            - Security measurements
            Systems Security
            - Cloud security, virtualization for security
            - Mobile devices security
            - Operating system security
            - Web applications security
            Malware and vulnerability analysis
            - Automated techniques for vulnerability discovery and analysis
            - Binary code analysis, reverse-engineering
            - Malware: detection, analysis, mitigation
            - Computer forensics
            Human factors
            - Usable security
            - Studies of developers’ behaviours
            - Organisational practices pertaining to secure development
            Infrastructure security
            - Security in critical infrastructures
            - Embedded software security
            - Security of cyber-physical systems and IoT