Ontologies for Security Requirements: A Literature Survey and Classification

Souag, Amina; Salinesi, Camille; Comyn-Wattiau, Isabelle

doi:10.1007/978-3-642-31069-0_5

Cited by 61 publications

(34 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…In [65] Souag et al present an analysis of existing security ontologies and their use in defining requirements. The work is part of a project that aims to improve the definition of security requirements using ontologies.…”

Section: Discussion and Related Workmentioning

confidence: 99%

See 1 more Smart Citation

A Survey of Security Assessment Ontologies

Rosa¹,

Jino²

2017

Advances in Intelligent Systems and Computing

View full text Add to dashboard Cite

Abstract.A literature survey on ontologies concerning the Security Assessment domain has been carried out to uncover initiatives that aim at formalizing concepts from the "Security Assessment" field of research. A preliminary analysis and a discussion on the selected works are presented. Our main contribution is an updated literature review, describing key characteristics, results, research issues, and application domains of the papers. We have also detected gaps in the Security Assessment literature that could be the subject of further studies in the field. This work is meant to be useful for security researchers who wish to adopt a formal approach in their methods.

show abstract

Section: Discussion and Related Workmentioning

confidence: 99%

“…The literature review was adapted from Barnes [66] and Rainer & Miller [67]. Blanco et al [64] and Souag et al [65] emphasize the importance of previous literature reviews and point to the need of updates.…”

Section: Discussion and Related Workmentioning

confidence: 99%

A Survey of Security Assessment Ontologies

Rosa¹,

Jino²

2017

Advances in Intelligent Systems and Computing

View full text Add to dashboard Cite

show abstract

“…11 For brevity reasons we omit most of the entity attributes. 12 A literature survey of different security requirements ontologies is given in [51]. 13 Please note that additionally also relationships between SRS in a SRS category may be possible, e.g., if a threat can be assigned to a related weakness, or if raw requirements are similar and relate to other raw requirements derived from compliance obligations.…”

Section: Discussionmentioning

confidence: 99%

Getting Grip on Security Requirements Elicitation by Structuring and Reusing Security Requirements Sources

Schmitt

Liggesmeyer

2015

CSIMQ

View full text Add to dashboard Cite

Abstract. This paper presents a model for structuring and reusing security requirements sources. The model serves as blueprint for the development of an organization-specific repository, which provides relevant security requirements sources, such as security information and knowledge sources and relevant compliance obligations, in a structured and reusable form. The resulting repository is intended to be used by development teams during the elicitation and analysis of security requirements with the goal to understand the security problem space, incorporate all relevant requirements sources, and to avoid unnecessary effort for identifying, understanding, and correlating applicable security requirements sources on a project-wise basis. We start with an overview and categorization of important security requirements sources, followed by the description of the generic model. To demonstrate the applicability and benefits of the model, the instantiation approach and details of the resulting repository of security requirements sources are presented.

show abstract

“…Being "small", the ontology used affected the resulting requirements and the whole security requirements analysis process. In a previous research, several security ontologies were compared and classified [7]. The paper concluded that ontologies are good sources for security requirements engineering.…”

Section: Introductionmentioning

confidence: 97%

“…The benefits of such a security ontology would be manifold: it would help requirements engineers reporting incidents more effectively, reusing security requirements of the same domain and discussing issues together, for instance [6]. Several research studies have addressed the issue of knowledge for the field of security [7] [8]. The research presented in this paper is part of a larger ongoing research project that aims at proposing a method that exploits ontologies for security requirements engineering [9].…”

Section: Introductionmentioning

confidence: 99%

A Security Ontology for Security Requirements Elicitation

Souag¹,

Salinesi²,

Mazo³

et al. 2015

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

International audienceSecurity is an important issue that needs to be taken into account at all stages of information system development, including early requirements elicitation. Early analysis of security makes it possible to predict threats and their impacts and define adequate security requirements before the system is in place. Security requirements are difficult to elicit, analyze, and manage. The fact that analysts' knowledge about security is often tacit makes the task of security requirements elicitation even harder. Ontologies are known for being a good way to formalize knowledge. Ontologies, in particular, have been proved useful to support reusability. Requirements engineering based on predefined ontologies can make the job of requirement engineering much easier and faster. However, this very much depends on the quality of the ontology that is used. Some security ontologies for security requirements have been proposed in the literature. None of them stands out as complete. This paper presents a core and generic security ontology for security requirements engineering. Its core and generic status is attained thanks to its coverage of wide and high-level security concepts and relationships. We implemented the ontology and developed an interactive environment to facilitate the use of the ontology during the security requirements engineering process. The proposed security ontology was evaluated by checking its validity and completeness compared to other ontologies. Moreover, a controlled experiment with end-users was performed to evaluate its usability

show abstract

Ontologies for Security Requirements: A Literature Survey and Classification

Cited by 61 publications

References 26 publications

A Survey of Security Assessment Ontologies

A Survey of Security Assessment Ontologies

Getting Grip on Security Requirements Elicitation by Structuring and Reusing Security Requirements Sources

A Security Ontology for Security Requirements Elicitation

Contact Info

Product

Resources

About