The development of systems based on embedded components is a challenging task because of their distributed, reactive and real-time nature. From a security point of view, embedded devices are basically systems owned by a certain entity, used frequently as part of systems owned by other entities and operated in a potentially hostile environment. The development of security-enhanced systems of embedded components is a difficult task due to different types of threats that may affect such systems, and because the security in systems of embedded devices is currently added as an additional feature when the development is advanced, or avoided as a superfluous characteristic. We present in this paper a methodology for the analysis and modeling of threats and attacks for systems of embedded components. The Intruder Model allows us to describe possible actions a potential intruder can accomplish, depending on his/her capabilities, resources, etc. Using this information, we can define a Threat Model that will specify the threats and attacks that affect different security properties in specific domains.

No abstract

No abstract

Current approaches for software development fail in the integration of security aspects. Usually, this is because of the software complexity and the specific expertise needed for the integration of modern security solutions. In this paper we present the SERENITY Project which proposes a framework addressing this issue. SERENITY is based on the separation of the development of security solutions from the development of secure software supported by these security solutions. Both developments, security solutions and secure applications, are centered on the use of libraries of precise descriptions of reusable security solutions stored in the form of security patterns. This approach fits very well with new emerging scenarios such as ambient intelligence, ubiquitous computing, grids, etc. In this paper we present the development of a secure application based on these ideas, in order to do that, we introduce an Application Programming Interface (API) specially designed for use SERENITY advantages.

Improving e-government services by using data more effectively is a major focus globally. It requires Public Administrations to be transparent, accountable and provide trustworthy services that improve citizen confidence. However, despite all the technological advantages on developing such services and analysing security and privacy concerns, the literature does not provide evidence of frameworks and platforms that enable privacy analysis, from multiple perspectives, and take into account citizens' needs with regards to transparency and usage of citizens information. This paper presents the VisiOn (Visual Privacy Management in User Centric Open Requirements) platform, an outcome of a H2020 European Project. Our objective is to enable Public Administrations to analyse privacy and security from different perspectives, including requirements, threats, trust and law compliance. Finally, our platform-supported approach introduces the concept of Privacy Level Agreement (PLA) which allows Public Administrations to customise their privacy policies based on the privacy preferences of each citizen