arXiv subjects

Maha Sroor

Publications and source records attributed to Maha Sroor.

3 recordsLinked to original sources

arXiv2025

A Systematic Mapping Study on Risks and Vulnerabilities in Software Containers

Software containers are widely adopted for developing and deploying software applications. Despite their popularity, major security concerns arise during container development and deployment. Software Engineering (SE) research literature reveals a lack of reviewed, aggregated, and organized knowledge of risks, vulnerabilities, security practices, and tools in container-based systems development and deployment. Therefore, we conducted a Systematic Mapping Study (SMS) based on 129 selected primary studies to explore and organize existing knowledge on security issues in software container systems. Data from the primary studies enabled us to identify critical risks and vulnerabilities across the container life-cycle and categorize them using a novel taxonomy. Additionally, the findings highlight the causes and implications and provide a list of mitigation techniques to overcome these risks and vulnerabilities. Furthermore, we provide an aggregation of security practices and tools that can help support and improve the overall security of container systems. This study offers critical insights into the current landscape of security issues within software container systems. Our analysis highlights the need for future SE research to focus on security enhancement practices that strengthen container systems and develop effective mitigation strategies to comprehensively address existing risks and vulnerabilities.

cs.SE↗

arXiv2025

Managing Security Issues in Software Containers: From Practitioners Perspective

Software development industries are increasingly adopting containers to enhance the scalability and flexibility of software applications. Security in containerized projects is a critical challenge that can lead to data breaches and performance degradation, thereby directly affecting the reliability and operations of the container services. Despite the ongoing effort to manage the security issues in containerized projects in software engineering (SE) research, more focused investigations are needed to explore the human perspective of security management and the technical approaches to security management in containerized projects. This research aims to explore security management in containerized projects by exploring how SE practitioners perceive the security issues in containerized software projects and their approach to managing such issues. A clear understanding of security management in containerized projects will enable industries to develop robust security strategies that enhance software reliability and trust. To achieve this, we conducted two separate semi-structured interview studies to examine how practitioners approach security management. The first study focused on practitioners perceptions of security challenges in containerized environments, where we interviewed 15 participants between December 2022 and October 2023. The second study explored how to enhance container security, with 20 participants interviewed between October 2024 and December 2024. Analyzing the data from both studies reveals how SE practitioners address the various security challenges in containerized projects. Our analysis also identified the technical and non-technical enablers that can be utilized to enhance security.

cs.SE↗

arXiv2025

Containers as the Quantum Leap in Software Development

The goal of the project QLEAP (2022-24), funded by Business Finland and participating organizations, was to study using containers as elements of architecture design. Such systems include containerized AI systems, using containers in a hybrid setup (public/hybrid/private clouds), and related security concerns. The consortium consists of four companies that represent different concerns over using containers (Bittium, M-Files, Solita/ADE Insights, Vaadin) and one research organization (University of Jyv\"askyl\"a). In addition, it has received support from two Veturi companies - Nokia and Tietoevry - who have also participated in steering the project. Moreover, the SW4E ecosystem has participated in the project. This document gathers the key lessons learned from the project.

cs.SE↗