Security by design: an interdisciplinary systematic review and conceptual framework

Abstract

Background: Security by design is the approach to designing digital technologies that are foundationally secure. This approach has materialized in several software design methodologies. However, a close examination of these methodologies shows that digital technologies security is designed as a technical feature, with no concern for their interaction with human, social, and organizational factors. This research argues that, in order to produce a design methodology for developing secure software systems that integrates non-technical factors in their design, an interdisciplinary and integrative review of the ‘security by design’ concept is needed. Objectives: The present protocol details the work plan for a systematic scoping review on security by design and related concepts. This review seeks to (1) synthesize current definitions of ‘security by design’, (2) elaborate a conceptual map that shows how ‘security by design’ connects to other related concepts, and (3) identify the key principles of the ‘security by design’ approach. Design: This systematic review follows the PRISMA extension for scoping review. Six databases are searched for thematically relevant studies published in English. Studies included peer-reviewed publications, government or company documents, technical reports, or a doctoral theses. After the initial search, three researchers will screen the title and abstracts following a screening tool. The consistency of researchers’ classification will be measured by calculating the inter-rater reliability. The reading of full texts will determine the final eligibility. Finally, data will be extracted from the final sample of documents.