@inproceedings{vanAerssenLeichSchmidtetal.2022, author = {van Aerssen, Max and Leich, Christian and Schmidt, Holger and Al Ali, Salar and Benni, Abdulkader and Tanz, Jakob}, title = {CopypastaVulGuard - A browser extension to prevent copy and paste spreading of vulnerable source code in forum posts}, series = {ARES '22: Proceedings of the 17th International Conference on Availability, Reliability and Security}, booktitle = {ARES '22: Proceedings of the 17th International Conference on Availability, Reliability and Security}, publisher = {Association for Computing Machinery}, address = {New York}, doi = {10.1145/3538969.3538973}, pages = {1 -- 8}, year = {2022}, abstract = {Forums such as Stack Overflow are used by many software developers to find a solution for a given coding problem. Found solutions, i.e. forum posts containing relevant source code, are utilized in a copy and paste manner. This behavior carries the risk that vulnerabilities contained in the source code of the forum posts are spread. Software developers should be able to identify vulnerable source code at an early stage, thereby preventing copying the corresponding source code. In this paper, we introduce the tool CopypastaVulGuard that identifies vulnerable source code in forum posts and allows software developers to omit the source code by marking the forum posts as dangerous. Our tool consists of a browser extension and a management application capable to address as examples SQL injections, remote code executions and deprecated functions based on a dump of the archive.org Stack Overflow data set. We present an evaluation of our tool's possible impact and relevance considering pros/cons and selected research questions.}, language = {en} } @inproceedings{BeckersEickerFassbenderetal.2012, author = {Beckers, Kristian and Eicker, Stefan and Faßbender, Stephan and Heisel, Maritta and Schmidt, Holger and Schwittek, Widura}, title = {Ontology-Based Identification of Research Gaps and Immature Research Areas}, series = {Multidisciplinary Research and Practice for Information Systems: IFIP WG 8.4, 8.9/TC 5 International Cross-Domain Conference and Workshop on Availability, Reliability, and Security, CD-ARES 2012, Prague, Czech Republic, August 20-24, 2012. Proceedings}, volume = {LNCS, 7465}, booktitle = {Multidisciplinary Research and Practice for Information Systems: IFIP WG 8.4, 8.9/TC 5 International Cross-Domain Conference and Workshop on Availability, Reliability, and Security, CD-ARES 2012, Prague, Czech Republic, August 20-24, 2012. Proceedings}, editor = {Quirchmayr, Gerald and Basl, Josef and You, Ilsun and Xu, Lida and Weippl, Edgar}, publisher = {Springer}, address = {Berlin, Heidelberg}, isbn = {978-3-642-32497-0}, issn = {1611-3349}, doi = {10.1007/978-3-642-32498-7_1}, pages = {1 -- 16}, year = {2012}, language = {en} } @inproceedings{BeckersFassbenderHeiseletal.2012, author = {Beckers, Kristian and Faßbender, Stephan and Heisel, Maritta and Schmidt, Holger}, title = {Using Security Requirements Engineering Approaches to Support ISO 27001 Information Security Management Systems Development and Documentation}, series = {2012 Seventh International Conference on Availability, Reliability and Security}, booktitle = {2012 Seventh International Conference on Availability, Reliability and Security}, publisher = {IEEE}, address = {Prague}, isbn = {978-1-4673-2244-7}, doi = {10.1109/ARES.2012.35}, pages = {242 -- 248}, year = {2012}, abstract = {An ISO 27001 compliant information security management system is difficult to create, due to the the limited support for system development and documentation provided in the standard. We present a structured analysis of the documentation and development requirements in the ISO 27001 standard. Moreover, we investigate to what extent existing security requirements engineering approaches fulfill these requirements. We developed relations between these approaches and the ISO 27001 standard using a conceptual framework originally developed for comparing security requirements engineering methods. The relations include comparisons of important terms, techniques, and documentation artifacts. In addition, we show practical applications of our results.}, language = {en} } @inproceedings{BeckersFassbenderHeiseletal.2012, author = {Beckers, Kristian and Faßbender, Stephan and Heisel, Maritta and K{\"u}ster, Jan-Christoph and Schmidt, Holger}, title = {Supporting the Development and Documentation of ISO 27001 Information Security Management Systems through Security Requirements Engineering Approaches}, series = {Engineering Secure Software and Systems: 4th International Symposium, ESSoS 2012, Eindhoven, The Netherlands, February, 16-17, 2012. Proceedings}, volume = {LNCS, 7159}, booktitle = {Engineering Secure Software and Systems: 4th International Symposium, ESSoS 2012, Eindhoven, The Netherlands, February, 16-17, 2012. Proceedings}, editor = {Barthe, Gilles and Livshits, Benjamin and Scandariato, Riccardo}, publisher = {Springer}, address = {Berlin, Heidelberg}, isbn = {978-3-642-28165-5}, doi = {10.1007/978-3-642-28166-2_2}, pages = {14 -- 21}, year = {2012}, language = {en} } @inproceedings{BeckersFassbenderKuesteretal.2012, author = {Beckers, Kristian and Faßbender, Stephan and K{\"u}ster, Jan-Christoph and Schmidt, Holger}, title = {A Pattern-Based Method for Identifying and Analyzing Laws}, series = {Requirements Engineering: Foundation for Software Quality: 18th International Working Conference, REFSQ 2012, Essen, Germany, March 19-22, 2012. Proceedings}, volume = {LNCS, 7195}, booktitle = {Requirements Engineering: Foundation for Software Quality: 18th International Working Conference, REFSQ 2012, Essen, Germany, March 19-22, 2012. Proceedings}, editor = {Regnell, Bj{\"o}rn and Damian, Daniela}, publisher = {Springer}, address = {Berlin, Heidelberg}, isbn = {978-3-642-28713-8}, doi = {10.1007/978-3-642-28714-5_23}, pages = {256 -- 262}, year = {2012}, language = {en} } @inproceedings{SchwittekSchmidtBeckersetal.2012, author = {Schwittek, Widura and Schmidt, Holger and Beckers, Kristian and Eicker, Stefan and Faßbender, Stephan and Heisel, Maritta}, title = {A Common Body of Knowledge for Engineering Secure Software and Services}, series = {2012 Seventh International Conference on Availability, Reliability and Security}, volume = {NESSoS, ICT-2009.1.4 Trustworthy ICT, Grant No. 25698}, booktitle = {2012 Seventh International Conference on Availability, Reliability and Security}, publisher = {IEEE}, address = {Prague}, isbn = {978-1-4673-2244-7}, doi = {10.1109/ARES.2012.31}, pages = {499 -- 506}, year = {2012}, abstract = {The discipline of engineering secure software and services brings together researchers and practitioners from software, services, and security engineering. This interdisciplinary community is fairly new, it is still not well integrated and is therefore confronted with differing perspectives, processes, methods, tools, vocabularies, and standards. We present a Common Body of Knowledge (CBK) to overcome the aforementioned problems. We capture use cases from research and practice to derive requirements for the CBK. Our CBK collects, integrates, and structures knowledge from the different disciplines based on an ontology that allows one to semantically enrich content to be able to query the CBK. The CBK heavily relies on user participation, making use of the Semantic MediaWiki as a platform to support collaborative writing. The ontology is complemented by a conceptual framework, consisting of concepts to structure the knowledge and to provide access to it, and a means to build a common terminology. We also present organizational factors covering dissemination and quality assurance.}, language = {en} } @inproceedings{BeckersFassbenderSchmidt2012, author = {Beckers, Kristian and Faßbender, Stephan and Schmidt, Holger}, title = {An Integrated Method for Pattern-Based Elicitation of Legal Requirements Applied to a Cloud Computing Example}, series = {2012 Seventh International Conference on Availability, Reliability and Security}, booktitle = {2012 Seventh International Conference on Availability, Reliability and Security}, publisher = {IEEE}, address = {Prague}, isbn = {978-0-7695-4775-6}, doi = {10.1109/ARES.2012.25}, pages = {463 -- 472}, year = {2012}, abstract = {Considering legal aspects during software development is a challenging problem, due to the cross-disciplinary expertise required. The problem is even more complex for cloud computing systems, because of the international distribution, huge amounts of processed data, and a large number of stakeholders that own or process the data. Approaches exist to deal with parts of the problem, but they are isolated from each other. We present an integrated method for elicitation of legal requirements. A cloud computing online banking scenario illustrates the application of our methods. The running example deals with the problem of storing personal information in the cloud and based upon the BDSG (German Federal Data Protection Act). We describe the structure of the online banking cloud system using an existing pattern-based approach. The elicited information is further refined and processed into functional requirements for software development. Moreover, our method covers the analysis of security-relevant concepts such as assets and attackers particularly with regard to laws. The requirements artifacts then serve as inputs for existing patterns for the identification of laws relevant for the online banking cloud system. Finally, our method helps to systematically derive functional as well as security requirements that realize the previously identified laws.}, language = {en} } @inproceedings{JuerjensOchoaSchmidtetal.2011, author = {J{\"u}rjens, Jan and Ochoa, Mart{\´i}n and Schmidt, Holger and Marchal, Lo{\"i}c and Houmb, Siv Hilde and Islam, Shareeful}, title = {Modelling Secure Systems Evolution: Abstract and Concrete Change Specifications}, series = {Formal Methods for Eternal Networked Software Systems: 11th International School on Formal Methods for the Design of Computer, Communication and Software Systems, SFM 2011, Bertinoro, Italy, June 13-18, 2011. Advanced Lectures}, volume = {LNCS, 6659}, booktitle = {Formal Methods for Eternal Networked Software Systems: 11th International School on Formal Methods for the Design of Computer, Communication and Software Systems, SFM 2011, Bertinoro, Italy, June 13-18, 2011. Advanced Lectures}, editor = {Bernardo, Marco and Issarny, Val{\´e}rie}, publisher = {Springer}, address = {Berlin, Heidelberg}, isbn = {978-3-642-21455-4}, doi = {10.1007/978-3-642-21455-4_15}, pages = {504 -- 526}, year = {2011}, abstract = {Developing security-critical systems is difficult, and there are many well-known examples of vulnerabilities exploited in practice. In fact, there has recently been a lot of work on methods, techniques, and tools to improve this situation already at the system specification and design. However, security-critical systems are increasingly long-living and undergo evolution throughout their lifetime. Therefore, a secure software development approach that supports maintaining the needed levels of security even through later software evolution is highly desirable. In this chapter, we recall the UMLsec approach to model-based security and discuss on tools and techniques to model and verify evolution of UMLsec models.}, language = {en} } @inproceedings{HeymanYskoutScandariatoetal.2011, author = {Heyman, Thomas and Yskout, Koen and Scandariato, Riccardo and Schmidt, Holger and Yu, Yijun}, title = {The Security Twin Peaks}, series = {Engineering Secure Software and Systems: Third International Symposium, ESSoS 2011, Madrid, Spain, February 9-10, 2011. Proceedings}, volume = {LNCS}, booktitle = {Engineering Secure Software and Systems: Third International Symposium, ESSoS 2011, Madrid, Spain, February 9-10, 2011. Proceedings}, number = {6542}, editor = {Erlingsson, {\´U}lfar and Wieringa, Roel and Zannone, Nicola}, publisher = {Springer}, address = {Berlin, Heidelberg}, isbn = {978-3-642-19124-4}, doi = {10.1007/978-3-642-19125-1_13}, pages = {167 -- 180}, year = {2011}, language = {en} } @inproceedings{HateburHeiselJuerjensetal.2011, author = {Hatebur, Denis and Heisel, Maritta and J{\"u}rjens, Jan and Schmidt, Holger}, title = {Systematic Development of UMLsec Design Models Based on Security Requirements}, series = {Fundamental Approaches to Software Engineering: 14th International Conference, FASE 2011, Held as Part of the Joint European Conferences on Theory and Practice of Software, ETAPS 2011, Saarbr{\"u}cken, Germany, March 26-April 3, 2011. Proceedings}, volume = {LNCS, 6603}, booktitle = {Fundamental Approaches to Software Engineering: 14th International Conference, FASE 2011, Held as Part of the Joint European Conferences on Theory and Practice of Software, ETAPS 2011, Saarbr{\"u}cken, Germany, March 26-April 3, 2011. Proceedings}, editor = {Giannakopoulou, Dimitra and Orejas, Fernando}, publisher = {Springer}, address = {Berlin, Heidelberg}, isbn = {978-3-642-19810-6}, doi = {10.1007/978-3-642-19811-3_17}, pages = {232 -- 246}, year = {2011}, language = {en} }