On modelling access policies: relating roles to their organisational context

Crook, Robert; Ince, Darrel C.; Nuseibeh, Bashar

doi:10.1109/re.2005.48

Cited by 35 publications

(14 citation statements)

References 33 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This approach to RE is reactive and focuses on low level security requirements. The work on high level security policies on methodologies for structuring, modeling and reasoning is done in [12] [13] [14]. But the behavioral specification of threats, attacks should be optimized at RE and design level.…”

Section: Realization Of Security At Re Levelmentioning

confidence: 99%

A Review of Requirement Engineering Issues and Challenges in Various Software Development Methods

Shah¹,

Patel²

2014

IJCA

View full text Add to dashboard Cite

The Requirement Engineering (RE) is a systemic and integrated process of eliciting, elaborating, negotiating, prioritizing, specifying, validating and managing the requirements of a system. The detailed and agreed requirements are documented and specified to serve as the basis for further system development activities. The software industry has moved from traditional software development method to service oriented software development. While many researchers and practitioners have observed issues and challenges in Requirement Engineering phase specific to a software method, very little attention has been given to investigate diversity of issues and challenges of RE in different software development methods under one umbrella. This paper tries to review significant issues and challenges of RE from traditional software development method to recent service oriented software development method. The study unveils that there is a wide scope for developing new approaches and techniques in requirement engineering to resolve problems observed in various SE methods. The review discussion reveals the need of standardization and automation of RE process especially for Service oriented software development.

show abstract

Section: Realization Of Security At Re Levelmentioning

confidence: 99%

A Review of Requirement Engineering Issues and Challenges in Various Software Development Methods

Shah¹,

Patel²

2014

IJCA

View full text Add to dashboard Cite

show abstract

“…We continue to use access control as an example to illustrate a hierarchy due to its large amount of related work including various aspects and specialized models [32,33,34,35]. Not only is it a commonly understood aspect of security, but it also includes many facets which allow us to demonstrate the different benefits of using a feature diagram to illustrate the pattern.…”

Section: Pattern Hierarchymentioning

confidence: 99%

Managing security requirements patterns using feature diagram hierarchies

Slavin

Lehker

Niu

et al. 2014

2014 IEEE 22nd International Requirements Engineering Conference (RE)

View full text Add to dashboard Cite

Abstract-Security requirements patterns represent reusable security practices that software engineers can apply to improve security in their system. Reusing best practices that others have employed could have a number of benefits, such as decreasing the time spent in the requirements elicitation process or improving the quality of the product by reducing product failure risk. Pattern selection can be difficult due to the diversity of applicable patterns from which an analyst has to choose. The challenge is that identifying the most appropriate pattern for a situation can be cumbersome and time-consuming. We propose a new method that combines an inquiry-cycle based approach with the feature diagram notation to review only relevant patterns and quickly select the most appropriate patterns for the situation. Similar to patterns themselves, our approach captures expert knowledge to relate patterns based on decisions made by the pattern user. The resulting pattern hierarchies allow users to be guided through these decisions by questions, which elicit and refine requirements as well as introduce related patterns. Furthermore, our approach is unique in the way that pattern forces are interpreted as quality attributes to balance trade-offs in the resulting requirements. We evaluate our approach using access control patterns in a pattern user study.

show abstract

“…These characteristics are the line of authority (vertical differentiation) and the division of work (horizontal differentiation). We can capture this with the use of the three basic framework elements: "authority," representing the level of authority; "org_function," representing the differentiation of organizational functions; and "org_domain," representing differentiations according to market-based characteristics (Crook, Ince, & Nuseibeh, 2005). …”

Section: The Proposed Infrastructure and Role Decomposition Processmentioning

confidence: 99%

A Role Engineering Framework to Support Dynamic Authorizations in Collaborative Environments

Baltatzis

Ilioudis

Pangalos

2012

Information Security Journal: A Global Perspective

View full text Add to dashboard Cite

With the increasing availability of networks and the advancements in their underlying infrastructure of mobile devices, access control and authorization issues will be enablers of future technologies in collaborative environments. Recent works demonstrate efforts to dynamically authorize users without prior knowledge and with no security configuration attributes or roles previously assigned to them. Moreover, current role-based engineering approaches construct role hierarchies without reflecting the organizational structure, since they do not take into account structural organizational characteristics. In this paper we propose an innovative role structure, not solely dependent on naming methods but also that takes into account organizational as well as functional characteristics to provide a practical role assignment methodology between organizations in a collaborative environment. More specifically, we argue that beyond the fact that a role represents a job assignment to perform certain function(s), it is also a composite element representing several organizational characteristics such as organizational function, organizational domain and level of authority. The proposed role structure enables role-to-role assignment as external nonlocal users request access in a particular information system (e.g., people on the move, users logged in from a collaborative organization) and acquire local role(s). A clear advantage in the proposed framework is its flexibility in the role assignment process, since the proposed role decomposition does not require an exact match of predefined credentials. The methodology is autonomous, as no prior trust establishment is required between interactive organizations, expendable as new organizations can join the collaboration without affecting the existing ones, flexible as it does not affect the local access control policy, scalable as the collaboration can increase arbitrary and efficient as the comparison methodology guarantees the selection of the appropriate local role, if such one exists.

show abstract

On modelling access policies: relating roles to their organisational context

Abstract: Abstract

Cited by 35 publications

References 33 publications

A Review of Requirement Engineering Issues and Challenges in Various Software Development Methods

A Review of Requirement Engineering Issues and Challenges in Various Software Development Methods

Managing security requirements patterns using feature diagram hierarchies

A Role Engineering Framework to Support Dynamic Authorizations in Collaborative Environments

Contact Info

Product

Resources

About