Risk as Dependability Metrics for the Evaluation of Business Solutions: A Model-driven Approach

Abstract

The analysis of business solutions is one of critical issues in industry. Risk is one of the most preeminent and accepted metrics for the evaluation of business solutions. Not surprisingly, many research efforts have been devoted to develop risk management frameworks. Among them, Tropos Goal-Risk offers a formal framework for assessing and treating risks on the basis of the likelihood and severity of failures. In this paper, we extend the Tropos Goal-Risk to assess and treat risks by considering the interdependency among actors within an organization. To make the discussion more concrete, we apply the proposed framework for analysis of the risks within manufacturing organizations.

Requirements engineering within a large-scale security-oriented research project: lessons learned

“…It demonstrates how existing proposals can be adopted, integrated and extended in order to support the RE process in a large-scale research project. Section 4 reports the outcome of the application of these various methodologies and processes within the TAS 3 project. Section 5 presents guidelines for performing RE activities in large-scale research projects as we derive them from lessons learned.…”

“…Section 2 discusses the challenges of applying RE methodologies to large-scale research-oriented projects. Section 3 presents the RE methodologies and processes applied in the TAS 3 project. In particular, it investigates alternative proposals from researchers as well as industry best practices, for each RE activity.…”

“…In particular, the paper analyzes and discusses the challenges faced in the context of the TAS 3 project (http://www.tas3.eu), the RE process adopted to mitigate these challenges and an evaluation of the different RE activities. TAS 3 is an EU-integrated project focusing on the main security and privacy issues in distributed systems aiming to deploy a generic architecture for managing employability and healthcare personal information services. This project was initially conceived as an ''architecture-driven project''.…”

A Modeling Ontology for Integrating Vulnerabilities into Security Requirements Conceptual Foundations

“…Vulnerable actors take measures to mitigate perceived risks, by using locks on the doors, surveillance cameras, etc. Existing security requirements engineering frameworks focus on various aspects for eliciting security requirements, such as attacker behavior [29,31] and attacker goals [32], design of secure components [15], social aspects [18,11], and events that can cause system failure [1]. However, attacks and consequent security failures often take place because of the exploitation of weaknesses or backdoors within the system.…”

“…When the risk of an attack is higher than the risk tolerance of some stakeholder, analysts need to take the adequate measure to mitigate such risks [1]. A countermeasure is a protection mechanism employed to secure the system [30].…”