@incollection{SchmidtHateburHeisel2018, author = {Schmidt, Holger and Hatebur, Denis and Heisel, Maritta}, title = {Developing Secure Software Using UML Patterns}, series = {Intelligent systems: Concepts, methodologies, tools, and applications}, booktitle = {Intelligent systems: Concepts, methodologies, tools, and applications}, publisher = {IGI Global}, address = {Hershey, Pennsylvania}, organization = {Management Association, Information Resources}, isbn = {9781522556435}, doi = {10.4018/978-1-5225-5643-5.ch022}, pages = {551 -- 592}, year = {2018}, language = {en} } @inproceedings{HateburHeiselSchmidt2007, author = {Hatebur, Denis and Heisel, Maritta and Schmidt, Holger}, title = {A Security Engineering Process based on Patterns}, series = {18th International Workshop on Database and Expert Systems Applications (DEXA 2007)}, booktitle = {18th International Workshop on Database and Expert Systems Applications (DEXA 2007)}, publisher = {IEEE}, address = {Regensburg}, isbn = {978-0-7695-2932-5}, doi = {10.1109/DEXA.2007.36}, pages = {734 -- 738}, year = {2007}, abstract = {We present a security engineering process based on security problem frames and concretized security problem frames. Both kinds of frames constitute patterns for analyzing security problems and associated solution approaches. They are arranged in a pattern system that makes dependencies between them explicit. We describe step-by-step how the pattern system can be used to analyze a given security problem and how solution approaches can be found. Further, we introduce a new frame that focuses on the privacy requirement anonymity.}, language = {en} } @inproceedings{CoteHateburHeiseletal.2008, author = {C{\^o}t{\´e}, Isabelle and Hatebur, Denis and Heisel, Maritta and Schmidt, Holger and Wentzlaff, Ina}, title = {A Systematic Account of Problem Frames}, series = {Proceedings of the 12th European Conference on Pattern Languages of Programs (EuroPLoP '2007), Irsee, Germany, July 4-8, 2007.}, booktitle = {Proceedings of the 12th European Conference on Pattern Languages of Programs (EuroPLoP '2007), Irsee, Germany, July 4-8, 2007.}, publisher = {Universit{\"a}tsverlag Konstanz}, address = {Konstanz}, pages = {749 -- 767}, year = {2008}, abstract = {We give an enumeration of possible problem frames, based on domain characteristics, and comment on the usefulness of the obtained frames. In particular, we investigate problem domains and their characteristics in detail. This leads to fine-grained criteria for describing problem domains. As a result, we identify a new type of problem domain and come up with integrity conditions for developing useful problem frames. Taking a complete enumeration of possible problem frames (with at most three problem domains, of which only one is constrained) as a basis, we find 8 new problem frames, 7 of which we consider as useful in practical software development.}, language = {en} } @inproceedings{HateburHeiselSchmidt2006, author = {Hatebur, Denis and Heisel, Maritta and Schmidt, Holger}, title = {Security Engineering Using Problem Frames}, series = {Emerging Trends in Information and Communication Security: International Conference, ETRICS 2006, Freiburg, Germany, June 6-9, 2006. Proceeding}, volume = {LNCS, 3995}, booktitle = {Emerging Trends in Information and Communication Security: International Conference, ETRICS 2006, Freiburg, Germany, June 6-9, 2006. Proceeding}, editor = {M{\"u}ller, G{\"u}nter}, publisher = {Springer}, address = {Berlin, Heidelberg}, isbn = {978-3-540-34640-1}, doi = {10.1007/11766155_17}, pages = {238 -- 253}, year = {2006}, language = {en} } @inproceedings{HateburHeiselSchmidt2007, author = {Hatebur, Denis and Heisel, Maritta and Schmidt, Holger}, title = {A Pattern System for Security Requirements Engineering}, series = {The Second International Conference on Availability, Reliability and Security (ARES'07)}, booktitle = {The Second International Conference on Availability, Reliability and Security (ARES'07)}, publisher = {IEEE}, address = {Vienna}, isbn = {0-7695-2775-2}, doi = {10.1109/ARES.2007.12}, pages = {10}, year = {2007}, abstract = {We present a pattern system/or security requirements engineering, consisting of security problem frames and concretized security problem frames. These are special kinds of problem frames that serve to structure, characterize, analyze, and finally solve software development problems in the area of software and system security. We equip each frame with formal preconditions and postconditions. The analysis of these conditions results in a pattern system that explicitly shows the dependencies between the different frames. Moreover, we indicate related frames, which are commonly used together with the considered frame. Hence, our approach helps security engineers to avoid omissions and to cover all security requirements that are relevant for a given problem.}, language = {en} } @inproceedings{HateburHeiselSchmidt2008, author = {Hatebur, Denis and Heisel, Maritta and Schmidt, Holger}, title = {A Formal Metamodel for Problem Frames}, series = {Model Driven Engineering Languages and Systems: 11th International Conference, MoDELS 2008, Toulouse, France, September 28 - October 3, 2008. Proceedings}, volume = {LNCS, 5301}, booktitle = {Model Driven Engineering Languages and Systems: 11th International Conference, MoDELS 2008, Toulouse, France, September 28 - October 3, 2008. Proceedings}, editor = {Czarnecki, Krzysztof and Ober, Ileana and Bruel, Jean-Michel and Uhl, Axel and V{\"o}lter, Markus}, publisher = {Springer}, address = {Berlin, Heidelberg}, isbn = {978-3-540-87874-2}, doi = {10.1007/978-3-540-87875-9_5}, pages = {58 -- 82}, year = {2008}, abstract = {Problem frames are patterns for analyzing, structuring, and characterizing software development problems. This paper presents a formal metamodel for problem frames expressed in UML class diagrams and using the formal specification notation OCL. That metamodel clarifies the nature of the different syntactical elements of problem frames, as well as the relations between them. It provides a framework for syntactical analysis and semantic validation of newly defined problem frames, and it prepares the ground for tool support for the problem frame approach.}, language = {de} } @inproceedings{HateburHeiselSchmidt2008, author = {Hatebur, Denis and Heisel, Maritta and Schmidt, Holger}, title = {Analysis and Component-based Realization of Security Requirements}, series = {2008 Third International Conference on Availability, Reliability and Security}, booktitle = {2008 Third International Conference on Availability, Reliability and Security}, publisher = {IEEE}, address = {Barcelona}, isbn = {978-0-7695-3102-1}, doi = {10.1109/ARES.2008.27}, pages = {195 -- 203}, year = {2008}, abstract = {We present a process to develop secure software with an extensive pattern-based security requirements engineering phase. It supports identifying and analyzing conflicts between different security requirements. In the design phase, we proceed by selecting security software components that achieve security requirements. The process enables software developers to systematically identify, analyze, and finally realize security requirements using security software components. We illustrate our approach by a lawyer agency software example.}, language = {en} } @article{FabianGuersesHeiseletal.2010, author = {Fabian, Benjamin and G{\"u}rses, Seda and Heisel, Maritta and Santen, Thomas and Schmidt, Holger}, title = {A comparison of security requirements engineering methods}, series = {Requirements Engineering}, volume = {15}, journal = {Requirements Engineering}, number = {1}, publisher = {Springer}, address = {Wiesbaden}, issn = {0947-3602}, doi = {10.1007/s00766-009-0092-x}, pages = {7 -- 40}, year = {2010}, abstract = {This paper presents a conceptual framework for security engineering, with a strong focus on security requirements elicitation and analysis. This conceptual framework establishes a clear-cut vocabulary and makes explicit the interrelations between the different concepts and notions used in security engineering. Further, we apply our conceptual framework to compare and evaluate current security requirements engineering approaches, such as the Common Criteria, Secure Tropos, SREP, MSRA, as well as methods based on UML and problem frames. We review these methods and assess them according to different criteria, such as the general approach and scope of the method, its validation, and quality assurance capabilities. Finally, we discuss how these methods are related to the conceptual framework and to one another.}, language = {en} } @inproceedings{SchwittekSchmidtEickeretal.2011, author = {Schwittek, Widura and Schmidt, Holger and Eicker, Stefan and Heisel, Maritta}, title = {Towards a Common Body of Knowledge for Engineering Secure Software and Services}, series = {Proceedings of the International Conference on Knowledge Management and Information Sharing}, booktitle = {Proceedings of the International Conference on Knowledge Management and Information Sharing}, editor = {Filipe, Joaquim and Liu, Kecheng}, publisher = {SciTePress - Science and Technology Publications}, address = {Paris}, pages = {369 -- 374}, year = {2011}, abstract = {Interdisciplinary communities involve people and knowledge from different disciplines in addressing a common challenge. Differing perspectives, processes, methods, tools, vocabularies, and standards are problems that arise in this context. We present an approach to support bringing together disciplines based on a common body of knowledge (CBK), in which knowledge from different disciplines is collected, integrated, and structured. The novelty of our approach is twofold: first, it introduces a CBK ontology, which allows one to semantically enrich contents in order to be able to query the CBK in a more elaborate way afterwards. Second, it heavily relies on user participation in building up a CBK, making use of the Semantic MediaWiki as a platform to support collaborative writing. The CBK ontology is backed by a conceptual framework, consisting of concepts to structure the knowledge, to provide access options to it, and to build up a common terminology. To ensure a high quality of the provided contents and to sustain the community's commitment, we further present organizational means as part of our approach. We demonstrate our work using the example of a Network of Excellence EU project, which aims at bringing together researchers and practitioners from services computing, security and software engineering.}, language = {en} } @inproceedings{CoteHeiselSchmidtetal.2011, author = {C{\^o}t{\´e}, Isabelle and Heisel, Maritta and Schmidt, Holger and Hatebur, Denis}, title = {UML4PF — A tool for problem-oriented requirements analysis}, series = {2011 IEEE 19th International Requirements Engineering Conference}, booktitle = {2011 IEEE 19th International Requirements Engineering Conference}, publisher = {IEEE}, address = {Trento}, isbn = {978-1-4577-0924-1}, doi = {10.1109/RE.2011.6051670}, pages = {349 -- 350}, year = {2011}, abstract = {We present UML4PF, a tool for requirements analysis based on problem frames. It consists of a UML profile and an Eclipse-Plugin to model and analyze problem diagrams, derive specifications, and develop architectures.}, language = {en} }