@inproceedings{vanAerssenLeichSchmidtetal.2022, author = {van Aerssen, Max and Leich, Christian and Schmidt, Holger and Al Ali, Salar and Benni, Abdulkader and Tanz, Jakob}, title = {CopypastaVulGuard - A browser extension to prevent copy and paste spreading of vulnerable source code in forum posts}, series = {ARES '22: Proceedings of the 17th International Conference on Availability, Reliability and Security}, booktitle = {ARES '22: Proceedings of the 17th International Conference on Availability, Reliability and Security}, publisher = {Association for Computing Machinery}, address = {New York}, doi = {10.1145/3538969.3538973}, pages = {1 -- 8}, year = {2022}, abstract = {Forums such as Stack Overflow are used by many software developers to find a solution for a given coding problem. Found solutions, i.e. forum posts containing relevant source code, are utilized in a copy and paste manner. This behavior carries the risk that vulnerabilities contained in the source code of the forum posts are spread. Software developers should be able to identify vulnerable source code at an early stage, thereby preventing copying the corresponding source code. In this paper, we introduce the tool CopypastaVulGuard that identifies vulnerable source code in forum posts and allows software developers to omit the source code by marking the forum posts as dangerous. Our tool consists of a browser extension and a management application capable to address as examples SQL injections, remote code executions and deprecated functions based on a dump of the archive.org Stack Overflow data set. We present an evaluation of our tool's possible impact and relevance considering pros/cons and selected research questions.}, language = {en} } @inproceedings{SchwittekSchmidtEickeretal.2011, author = {Schwittek, Widura and Schmidt, Holger and Eicker, Stefan and Heisel, Maritta}, title = {Towards a Common Body of Knowledge for Engineering Secure Software and Services}, series = {Proceedings of the International Conference on Knowledge Management and Information Sharing}, booktitle = {Proceedings of the International Conference on Knowledge Management and Information Sharing}, editor = {Filipe, Joaquim and Liu, Kecheng}, publisher = {SciTePress - Science and Technology Publications}, address = {Paris}, pages = {369 -- 374}, year = {2011}, abstract = {Interdisciplinary communities involve people and knowledge from different disciplines in addressing a common challenge. Differing perspectives, processes, methods, tools, vocabularies, and standards are problems that arise in this context. We present an approach to support bringing together disciplines based on a common body of knowledge (CBK), in which knowledge from different disciplines is collected, integrated, and structured. The novelty of our approach is twofold: first, it introduces a CBK ontology, which allows one to semantically enrich contents in order to be able to query the CBK in a more elaborate way afterwards. Second, it heavily relies on user participation in building up a CBK, making use of the Semantic MediaWiki as a platform to support collaborative writing. The CBK ontology is backed by a conceptual framework, consisting of concepts to structure the knowledge, to provide access options to it, and to build up a common terminology. To ensure a high quality of the provided contents and to sustain the community's commitment, we further present organizational means as part of our approach. We demonstrate our work using the example of a Network of Excellence EU project, which aims at bringing together researchers and practitioners from services computing, security and software engineering.}, language = {en} } @inproceedings{SchwittekSchmidtBeckersetal.2012, author = {Schwittek, Widura and Schmidt, Holger and Beckers, Kristian and Eicker, Stefan and Faßbender, Stephan and Heisel, Maritta}, title = {A Common Body of Knowledge for Engineering Secure Software and Services}, series = {2012 Seventh International Conference on Availability, Reliability and Security}, volume = {NESSoS, ICT-2009.1.4 Trustworthy ICT, Grant No. 25698}, booktitle = {2012 Seventh International Conference on Availability, Reliability and Security}, publisher = {IEEE}, address = {Prague}, isbn = {978-1-4673-2244-7}, doi = {10.1109/ARES.2012.31}, pages = {499 -- 506}, year = {2012}, abstract = {The discipline of engineering secure software and services brings together researchers and practitioners from software, services, and security engineering. This interdisciplinary community is fairly new, it is still not well integrated and is therefore confronted with differing perspectives, processes, methods, tools, vocabularies, and standards. We present a Common Body of Knowledge (CBK) to overcome the aforementioned problems. We capture use cases from research and practice to derive requirements for the CBK. Our CBK collects, integrates, and structures knowledge from the different disciplines based on an ontology that allows one to semantically enrich content to be able to query the CBK. The CBK heavily relies on user participation, making use of the Semantic MediaWiki as a platform to support collaborative writing. The ontology is complemented by a conceptual framework, consisting of concepts to structure the knowledge and to provide access to it, and a means to build a common terminology. We also present organizational factors covering dissemination and quality assurance.}, language = {en} } @inproceedings{SchmidtWentzlaff2006, author = {Schmidt, Holger and Wentzlaff, Ina}, title = {Preserving Software Quality Characteristics from Requirements Analysis to Architectural Design}, series = {Software Architecture: Third European Workshop, EWSA 2006, Nantes, France, September 4-5, 2006, Revised Selected Papers}, volume = {LNCS, 4344}, booktitle = {Software Architecture: Third European Workshop, EWSA 2006, Nantes, France, September 4-5, 2006, Revised Selected Papers}, editor = {Gruhn, Volker and Oquendo, Flavio}, publisher = {Springer}, address = {Berlin, Heidelberg}, isbn = {978-3-540-69271-3}, doi = {10.1007/11966104_14}, pages = {189 -- 203}, year = {2006}, language = {en} } @techreport{SchmidtJuerjens2011, author = {Schmidt, Holger and J{\"u}rjens, Jan}, title = {UMLsec4UML2 - Adopting UMLsec to Support UML2}, series = {LS 14 Software Engineering mit dem Schwerpunkt Entwicklung evolutionsf{\"a}higer Software und Systeme}, journal = {LS 14 Software Engineering mit dem Schwerpunkt Entwicklung evolutionsf{\"a}higer Software und Systeme}, publisher = {Technische Hochschule Dortmund}, address = {Dortmund}, doi = {10.17877/DE290R-990}, pages = {17}, year = {2011}, abstract = {In this paper, we present an approach to adopt UMLsec, which is defined for UML 1.5, to support the current UML version 2.3. The new profile UMLsec4UML2 is technically constructed as a UML profile diagram, which is equipped with a number of integrity conditions expressed using OCL. Consequently, the UMLsec4UML2-profile can be loaded in any Eclipse-based EMF- and MDT-compatible UML editing tool to develop and analyze different kinds of security models. The OCL constraints replace the static checks of the tool support for the old UMLsec defined for UML 1.5. Thus, the UMLsec4UML2-profile not only provides the whole expresiveness of UML2.3 for security modeling, it also brings considerably more freedom in selecting a basic UML editing tool, and it integrates modeling and analyzing security models. Since UML2.3 comprises new diagram types, as well as new model elements and new semantics of diagram types already contained in UML1.5, we consider a number of these changes in detail. More specifically, we consider composite structure and sequence diagrams with respect to modeling security properties according to the original version of UMLsec. The goal is to use UMLsec4UML2 to specify architectural security patterns.}, language = {en} } @inproceedings{SchmidtJuerjens2011, author = {Schmidt, Holger and J{\"u}rjens, Jan}, title = {Connecting Security Requirements Analysis and Secure Design Using Patterns and UMLsec}, series = {Advanced Information Systems Engineering: 23rd International Conference, CAiSE 2011, London, UK, June 20-24, 2011. Proceedings}, volume = {LNCS, 6741}, booktitle = {Advanced Information Systems Engineering: 23rd International Conference, CAiSE 2011, London, UK, June 20-24, 2011. Proceedings}, editor = {Mouratidis, Haralambos and Rolland, Colette}, publisher = {Springer}, address = {Berlin, Heidelberg}, isbn = {978-3-642-21639-8}, doi = {10.1007/978-3-642-21640-4_28}, pages = {367 -- 382}, year = {2011}, language = {en} } @incollection{SchmidtHateburHeisel2011, author = {Schmidt, Holger and Hatebur, Denis and Heisel, Maritta}, title = {A Pattern-Based Method to Develop Secure Software}, series = {Software Engineering for Secure Systems: Industrial and Research Perspectives}, booktitle = {Software Engineering for Secure Systems: Industrial and Research Perspectives}, editor = {Mouratidis, Haralambos}, publisher = {IGI Global}, address = {Hershey}, isbn = {978-1-61520-837-1}, doi = {10.4018/978-1-61520-837-1.ch003}, pages = {32 -- 74}, year = {2011}, abstract = {The authors present a security engineering process based on security problem frames and concretized security problem frames. Both kinds of frames constitute patterns for analyzing security problems and associated solution approaches. They are arranged in a pattern system that makes dependencies between them explicit. The authors describe step-by-step how the pattern system can be used to analyze a given security problem and how solution approaches can be found. Afterwards, the security problems and the solution approaches are formally modeled in detail. The formal models serve to prove that the solution approaches are correct solutions to the security problems. Furthermore, the formal models of the solution approaches constitute a formal specification of the software to be developed. Then, the specification is implemented by generic security components and generic security architectures, which constitute architectural patterns. Finally, the generic security components and the generic security architecture that composes them are refined and the result is a secure software product built from existing and/or tailor-made security components.}, language = {en} } @incollection{SchmidtHateburHeisel2018, author = {Schmidt, Holger and Hatebur, Denis and Heisel, Maritta}, title = {Developing Secure Software Using UML Patterns}, series = {Intelligent systems: Concepts, methodologies, tools, and applications}, booktitle = {Intelligent systems: Concepts, methodologies, tools, and applications}, publisher = {IGI Global}, address = {Hershey, Pennsylvania}, organization = {Management Association, Information Resources}, isbn = {9781522556435}, doi = {10.4018/978-1-5225-5643-5.ch022}, pages = {551 -- 592}, year = {2018}, language = {en} } @techreport{SchmidtGondolfHaufsBrusberg2018, author = {Schmidt, Holger and Gondolf, Jeremy and Haufs-Brusberg, Peter}, title = {Studie zur Information Security Awareness in kleinen und mittleren Unternehmen (KMU)}, publisher = {Hochschule D{\"u}sseldorf}, address = {D{\"u}sseldorf}, organization = {Hochschule D{\"u}sseldorf}, issn = {2625-3690}, doi = {10.20385/2625-3690/2018.1}, url = {http://nbn-resolving.de/urn:nbn:de:hbz:due62-opus-11880}, pages = {46}, year = {2018}, abstract = {Der Bereich der Informationssicherheit stellt große und insbesondere kleine und mittlere Unternehmen (KMU) vor erhebliche Herausforderungen. Zunehmende Angriffe auf IT-Systeme und Infrastrukturen haben die Informationssicherheit zum kritischen Erfolgsfaktor gemacht. Neben klassischen Zielen und Bereichen der Informationssicherheit hat vor allem die Security Awareness - das Sicherheitsbewusstsein aller Mitarbeiter eines Unternehmens - an Bedeutung gewonnen. Security Awareness bezieht sich auf jegliches Wissen und Handeln der Mitarbeiter eines Unternehmens und ist daher ein bedeutsamer Baustein zur ganzheitlichen Gewährleistung von Informationssicherheit. Die Motivation zur Entwicklung und Einf{\"u}hrung von Informationssicherheit und insbesondere Security Awareness geht in großen Unternehmen vor allem von externen Faktoren, so z. B. der Regulierung von Branchen, aus und ist mittels globaler Standards, Normen und Frameworks implementiert. KMU sind grundsätzlich keinen geringeren Risiken als große Unternehmen ausgesetzt, verf{\"u}gen jedoch nur selten {\"u}ber vergleichbare Schutzmaßnahmen hinsichtlich Informationssicherheit. Im Rahmen des Projekts wurden externe Anforderungen f{\"u}r große Unternehmen analysiert und hinsichtlich der Eignung als Grundlage f{\"u}r KMU bewertet. Das Projekt thematisiert weiterhin die Messbarkeit von Security Awareness sowie die in großen Unternehmen eingesetzten Maßnahmen zur Gewährleistung von Security Awareness besonders hinsichtlich ihrer Eignung f{\"u}r KMU.}, language = {de} } @article{Schmidt2011, author = {Schmidt, Holger}, title = {Threat and Risk-Driven Security Requirements Engineering}, series = {International Journal of Mobile Computing and Multimedia Communications}, volume = {3}, journal = {International Journal of Mobile Computing and Multimedia Communications}, number = {1}, publisher = {IGI Global}, issn = {1937-9412}, doi = {10.4018/jmcmc.2011010103}, pages = {35 -- 50}, year = {2011}, abstract = {In this paper, the author aim to present a threat and risk-driven methodology to security requirements engineering. The chosen approach has a strong focus on gathering, modeling, and analyzing the environment in which a secure ICT-system to be built is located. The knowledge about the environment comprises threat and risk models. As presented in the paper, this security-relevant knowledge is used to assess the adequacy of security mechanisms, which are then selected to establish security requirements.}, language = {en} }