A survey of interoperability in Enterprise Information Security Architecture frameworks

Bahmani, Faezeh; Shariati, Marzieh; Shams, Fereidoon

doi:10.1109/icise.2010.5691153

Cited by 3 publications

(1 citation statement)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In this context security architecture describes "a structured interrelationship between the technical and procedural solutions to support the long-term needs of the business" [SCL95]. SABSA [She05] is a well-known example of such frameworks which are surveyed well in [BSS10].…”

Section: Security Architecturementioning

confidence: 99%

A Threat Modeling Framework for Evaluating Computing Platforms Against Architectural Attacks

Musavi,

Hashemi

2018

Preprint

View full text Add to dashboard Cite

Architectural attacks are kinds of hardware-involved software attacks in which a software component misuse a privileged relationship with the hardware to by pass system protections, monitors, or forensic tools. These relationships are often not illegal and exist between system components by design. Hence, even a system with secure hardware and software components, can be architecturally vulnerable. Unfortunately, the existing threat modeling schemes are not applicable for modeling architectural attacks against computing platforms. This is mostly because the existing techniques rely on an abstract representation of a software (.e.g., Data Flow Diagram) as a primary requirement which is not available for a platform as a whole (considering both hardware and software elements). In this paper, we have discussed the necessity of a hardware-software architectural view to system threat modeling. Then, we have proposed Lamellae, a framework adapts threat modeling method to be applicable for untrusted platforms by a holistic approach. Lamellae involves system security architecture for abstract modeling of the platforms. Using the Design structure matrix analysis, Lamellae helps an end-user to identify possible attack vectors against a platform. The framework is a connection point of concepts from system engineering and software security domains. We have applied the framework on a multi-purpose computer with x86-64 architecture as a case-study to show the effectiveness of our framework.

show abstract

Section: Security Architecturementioning

confidence: 99%