No abstract

Component-Based Development (CBD) has a great potential of reducing development cost and time by integrating existing software components. But it also faces many challenges one of which is ensuring interoperability of the components that may have been developed with different functional and non-functional goals. The software community has traditionally focused more on the functional aspect of the interoperability such as syntactic and semantic compatibility. However, incompatibility from the non-functional aspect could lead to poor quality such as insufficient security or even inoperable system. This paper presents a preliminary framework for analyzing non-functional requirements (NFRs) defined for the component required and provided interfaces. The components are considered nonfunctionally interoperable when they agree on the definition and implementation techniques used to achieve the NFRs. Any detected mismatches can be resolved using a combination of the three presented tactics, including replacing the server component, negotiating for more attainable NFRs, or using an adapter component to bridge the non-functional differences. A running example based on a simplified web-based conference management system is used to illustrate the application of this framework.

Most attacks on computer and software systems are caused by threats to known vulnerabilities. Part of the reason is that it is difficult to possess necessary broad and deep knowledge of security related strategic knowledge to choose mitigating solutions suitable for a specific application or organization. This paper presents three patterns that use goaloriented concepts to capture knowledge of security problems and their corresponding mitigating solutions. Each pattern captures three kinds of problems, including undesirable outcome that negatively affects a security goal, threat that could lead to an undesirable outcome, and vulnerability that could be exploited by a threat. Alternative mitigating solutions are captured in relation to the problems, including vulnerability risk transfer, threat prevention, threat containment, undesirable outcome recovery, and undesirable outcome impact prevention and control. The alternatives are identified with consequences against other non-functional requirements (NFRs) such as cost and usability, which are then used as selection criteria in associated selection patterns. The patterns illustrate how knowledge of security incidents and security standards may be captured and used to help avoid the security problems suffered by TJX in one of the largest credit card theft incident in history.

No abstract

No abstract