No abstract

No abstract

No abstract

Recently, attacks on corporate websites are increasing and personal information on websites faces growing risks. Most developers are making efforts to establish secure system development processes. However, they have trouble with practice because they are busy and short of time or human resources. This paper describes a cooperative secure integration process that the authors actualize for secure system development and introduce the adapted management system.

Abstract. Because an information system is used in different activities simultaneously today, we have to analyze usages of the system in the existing activities and to-be usages in an intended activity together. Especially, security aspects should be carefully analyzed because existing activities are not always secure. We propose a security requirements analysis method for resolving this problem. To take both existing and intended activities into account together, we integrate them on the basis of the unification of common actors. To explore possible attacks under integrated activities, we enumerate achievable attacks on the basis of the possible means in each actor with the help of security knowledge. To avoid or mitigate the attacks and to achieve fundamental goals, we disable some means or narrow down the means to be monitored with the help of propositional logic formulae. Through case studies on insurance business, we illustrated our idea.