Eliciting security requirements and tracing them to design: an integration of Common Criteria, heuristics, and UMLsec

Houmb, Siv Hilde; Islam, Shareeful; Knauss, Eric; Jürjens, Jan; Schneider, Kurt

doi:10.1007/s00766-009-0093-9

Cited by 106 publications

(61 citation statements)

References 48 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Also, an additional specific cryptography-related information are extracted from different types of diagrams. The Dolev-Yao model of an attacker is included with UMLsec to model the interaction with the outside environment [43]. In [44], Jürjens verifies UMLsec models for security requirements: authentication, confidentiality, integrity, availability, and secrecy.…”

Section: Specification Of Security Requirementsmentioning

confidence: 99%

Specification, verification, and quantification of security in model-based systems

Ouchani

Debbabi

2015

Computing

View full text Add to dashboard Cite

Modern systems are more and more complex and security has become a key component in the success of software and systems development. The main challenge encountered in industry as well as in academia is to develop secure products, prove their security correctness, measure their resilience to attacks, and check if vulnerabilities exist. In this paper, we review the state-of-the-art related to security specification, verification, and quantification for software and systems that are modeled by using UML or SysML language. The reviewed work fall into the field of secure software and systems engineering that aims at fulfilling the security as an afterthought in the development of secure systems.

show abstract

Section: Specification Of Security Requirementsmentioning

confidence: 99%

Specification, verification, and quantification of security in model-based systems

Ouchani

Debbabi

2015

Computing

View full text Add to dashboard Cite

show abstract

“…Moreover, we have used our previous work in that area [5,11,[34][35][36][37][38][39] and we have also identified new concepts based on our analysis of the critical areas presented in the previous section. Finally we link these properties with the threats and issues relating to critical areas in cloud.…”

Section: Security and Privacy Properties And Threatsmentioning

confidence: 99%

“…The approach supports the analysis of security from the Requirements Engineering phase. Houmb et al introduced the SecReq approach to elicit, analyse and trace security requirements, starting from the requirements engineering phase to design [39]. A misuse case driven approach is used to establish visual links between use cases and misuse cases for eliciting security requirements at an early stage of the development [10].…”

Section: Related Workmentioning

confidence: 99%

Towards the design of secure and privacy-oriented information systems in the cloud: Identifying the major concepts

Kalloniatis

Mouratidis

Manousakis

et al. 2014

Computer Standards & Interfaces

Self Cite

View full text Add to dashboard Cite

Cloud computing is without a doubt one of the most significant innovations presented in the global technological map. This new generation of technology has the potential to positively change our lives since on the one hand it provides capabilities that make our digital lives much easier, than before, while on the other hand it assists developers in creating services that can be disseminated easier and faster, than before, and with significantly less cost.However, one of the major research challenges for the successful deployment of cloud services is a clear understanding of security and privacy issues on a cloud environment, since the cloud architecture has dissimilarities comparing to the traditional distributed systems.Such differences might introduce new threats and require different treatment of security and privacy issues. Nevertheless, current security and privacy requirements engineering techniques and methodologies have not been developed with cloud computing in mind and fail to capture the unique characteristics of such domain. It is therefore important to understand security and privacy within the context of cloud computing and identify relevant security and privacy properties and threats that will support techniques and methodologies aimed to analyze and design secure cloud based systems. The contribution of this paper to the literature is two-fold. Firstly, it provides a clear linkage between a set of critical cloud computing areas with security and privacy threats and properties. Secondly, it introduces a number of requirements for analysis and design methodologies to consider for security and privacy concerns in the cloud.3

show abstract

“…For example, Secure Tropos an extension of Tropos methodology proposed in [3] employs the concepts of security constraint, and secure dependency in order to model and analyze security issues during the requirements engineering phase. Similarly, the SecReq approach introduced in [4] describes a systematic approach to derive security requirements from system security objectives. In [5] misuse cases are used in order to represent security threats and to identify ''security use cases'', i.e., countermeasures that mitigate the threats.…”

Section: Related Workmentioning

confidence: 99%

Privacy as an Integral Part of the Implementation of Cloud Solutions

Kavakli

Kalloniatis

Mouratidis

et al. 2014

The Computer Journal

View full text Add to dashboard Cite

Bridging the gap between design and implementation stages has been a major concern of designers, analysts and developers of information systems and a major aspiration of a number of Information System (IS) engineering approaches. Cloud computing exacerbates the strain on traditional IS engineering approaches that service-oriented computing has started. At the same time, recent research has argued about the importance of security and privacy in a cloud environment and highlighted a number of security and privacy challenges that are not present in traditional environments and need special attention when implementing or migrating information systems into a cloud environment. This paper contributes to this direction. Specifically, it presents a number of privacy-related cloud properties that analysts need to consider when designing privacy-aware systems in a cloud environment. Also it indicates a number of implementation techniques that can assist developers in assuring the respective properties.

show abstract

Eliciting security requirements and tracing them to design: an integration of Common Criteria, heuristics, and UMLsec

Cited by 106 publications

References 48 publications

Specification, verification, and quantification of security in model-based systems

Specification, verification, and quantification of security in model-based systems

Towards the design of secure and privacy-oriented information systems in the cloud: Identifying the major concepts

Privacy as an Integral Part of the Implementation of Cloud Solutions

Contact Info

Product

Resources

About