Software systems are becoming more complex, interconnected and liable to adopt continuous change and evolution. It’s necessary to develop appropriate methods and techniques to ensure security and privacy of such systems. Research efforts that aim to ensure security and privacy of software systems are distinguished through two main categories: (1) the development of requirements engineering methods, and (2) implementation techniques. Approaches that fall in the first category usually aim to address either security or privacy in an implicit way, with emphasis on the security aspects by developing methods to elicit and analyse security (and privacy) requirements. Works that fall in the latter categories focus specifically on the later stages of the development process irrespective of the organisational context in which the system will be incorporated. This work introduces a model-based process for security and privacy requirements engineering. In particular, the authors’ work includes activities which support to identify and analyse security and privacy requirements for the software system. Their purpose process combines concepts from two well-known requirements engineering methods, Secure Tropos and PriS. A real case study from the EU project E-vote, i.e., an Internet based voting system, is employed to demonstrate the applicability of the approach.

No abstract

The Interdependency Modeling Tool and Simulation (IN-MOTOS) project is aimed to develop a tool for modeling and assessment of interdependent business-and contingency plans and risks a↵ecting them. In the scope of that project a methodology had to be created that enables the modeling of highly complex business processes, their structures and interdependencies, as well as threats and countermeasures. A time-based simulation of the impact of possible threats is required as well as a risk assessment by using multiple different impact calculations. The methodology shall be kept simple and flexible to enable modeling of a wide range of di↵erent business scenarios. For the fundamental basics the Risk-Oriented Process Evaluation (ROPE) methodology [7] was chosen due to its high flexibility. This paper describes the adaptations and enhancements that are applied on the ROPE methodology to refine it to the INMOTOS methodology.