TY - CHAP A1 - van Aerssen, Max A1 - Leich, Christian A1 - Schmidt, Holger A1 - Al Ali, Salar A1 - Benni, Abdulkader A1 - Tanz, Jakob T1 - CopypastaVulGuard - A browser extension to prevent copy and paste spreading of vulnerable source code in forum posts T2 - ARES '22: Proceedings of the 17th International Conference on Availability, Reliability and Security N2 - Forums such as Stack Overflow are used by many software developers to find a solution for a given coding problem. Found solutions, i.e. forum posts containing relevant source code, are utilized in a copy and paste manner. This behavior carries the risk that vulnerabilities contained in the source code of the forum posts are spread. Software developers should be able to identify vulnerable source code at an early stage, thereby preventing copying the corresponding source code. In this paper, we introduce the tool CopypastaVulGuard that identifies vulnerable source code in forum posts and allows software developers to omit the source code by marking the forum posts as dangerous. Our tool consists of a browser extension and a management application capable to address as examples SQL injections, remote code executions and deprecated functions based on a dump of the archive.org Stack Overflow data set. We present an evaluation of our tool's possible impact and relevance considering pros/cons and selected research questions. Y1 - 2022 U6 - https://doi.org/10.1145/3538969.3538973 SP - 1 EP - 8 PB - Association for Computing Machinery CY - New York ER - TY - CHAP A1 - Schmidt, Holger A1 - Hatebur, Denis A1 - Heisel, Maritta T1 - Developing Secure Software Using UML Patterns T2 - Intelligent systems: Concepts, methodologies, tools, and applications Y1 - 2018 SN - 9781522556435 U6 - https://doi.org/10.4018/978-1-5225-5643-5.ch022 SP - 551 EP - 592 PB - IGI Global CY - Hershey, Pennsylvania ER - TY - CHAP A1 - Hatebur, Denis A1 - Heisel, Maritta A1 - Schmidt, Holger T1 - A Security Engineering Process based on Patterns T2 - 18th International Workshop on Database and Expert Systems Applications (DEXA 2007) N2 - We present a security engineering process based on security problem frames and concretized security problem frames. Both kinds of frames constitute patterns for analyzing security problems and associated solution approaches. They are arranged in a pattern system that makes dependencies between them explicit. We describe step-by-step how the pattern system can be used to analyze a given security problem and how solution approaches can be found. Further, we introduce a new frame that focuses on the privacy requirement anonymity. KW - security engineering process KW - pattern system KW - data privacy KW - software development Y1 - 2007 UR - https://ieeexplore.ieee.org/abstract/document/4312991 SN - 978-0-7695-2932-5 U6 - https://doi.org/10.1109/DEXA.2007.36 N1 - Sie haben Zugriff auf den Volltext innerhalb des HSD Campus. SP - 734 EP - 738 PB - IEEE CY - Regensburg ER - TY - CHAP A1 - Côté, Isabelle A1 - Hatebur, Denis A1 - Heisel, Maritta A1 - Schmidt, Holger A1 - Wentzlaff, Ina T1 - A Systematic Account of Problem Frames T2 - Proceedings of the 12th European Conference on Pattern Languages of Programs (EuroPLoP '2007), Irsee, Germany, July 4-8, 2007. N2 - We give an enumeration of possible problem frames, based on domain characteristics, and comment on the usefulness of the obtained frames. In particular, we investigate problem domains and their characteristics in detail. This leads to fine-grained criteria for describing problem domains. As a result, we identify a new type of problem domain and come up with integrity conditions for developing useful problem frames. Taking a complete enumeration of possible problem frames (with at most three problem domains, of which only one is constrained) as a basis, we find 8 new problem frames, 7 of which we consider as useful in practical software development. KW - problem frames KW - systematic account Y1 - 2008 SP - 749 EP - 767 PB - Universitätsverlag Konstanz CY - Konstanz ER - TY - CHAP A1 - Schmidt, Holger A1 - Wentzlaff, Ina ED - Gruhn, Volker ED - Oquendo, Flavio T1 - Preserving Software Quality Characteristics from Requirements Analysis to Architectural Design T2 - Software Architecture: Third European Workshop, EWSA 2006, Nantes, France, September 4-5, 2006, Revised Selected Papers Y1 - 2006 UR - https://link.springer.com/chapter/10.1007/11966104_14 SN - 978-3-540-69271-3 U6 - https://doi.org/10.1007/11966104_14 VL - LNCS, 4344 SP - 189 EP - 203 PB - Springer CY - Berlin, Heidelberg ER - TY - CHAP A1 - Hatebur, Denis A1 - Heisel, Maritta A1 - Schmidt, Holger ED - Müller, Günter T1 - Security Engineering Using Problem Frames T2 - Emerging Trends in Information and Communication Security: International Conference, ETRICS 2006, Freiburg, Germany, June 6-9, 2006. Proceeding KW - security requirement KW - problem frames KW - security problem KW - security engineering KW - sequence diagram Y1 - 2006 UR - https://link.springer.com/chapter/10.1007/11766155_17 SN - 978-3-540-34640-1 U6 - https://doi.org/10.1007/11766155_17 VL - LNCS, 3995 SP - 238 EP - 253 PB - Springer CY - Berlin, Heidelberg ER - TY - CHAP A1 - Hatebur, Denis A1 - Heisel, Maritta A1 - Schmidt, Holger T1 - A Pattern System for Security Requirements Engineering T2 - The Second International Conference on Availability, Reliability and Security (ARES'07) N2 - We present a pattern system/or security requirements engineering, consisting of security problem frames and concretized security problem frames. These are special kinds of problem frames that serve to structure, characterize, analyze, and finally solve software development problems in the area of software and system security. We equip each frame with formal preconditions and postconditions. The analysis of these conditions results in a pattern system that explicitly shows the dependencies between the different frames. Moreover, we indicate related frames, which are commonly used together with the considered frame. Hence, our approach helps security engineers to avoid omissions and to cover all security requirements that are relevant for a given problem. KW - pattern system KW - system security KW - security KW - software development KW - computer security Y1 - 2007 UR - https://ieeexplore.ieee.org/abstract/document/4159824 SN - 0-7695-2775-2 U6 - https://doi.org/10.1109/ARES.2007.12 PB - IEEE CY - Vienna ER - TY - CHAP A1 - Hatebur, Denis A1 - Heisel, Maritta A1 - Schmidt, Holger T1 - Analysis and Component-based Realization of Security Requirements T2 - 2008 Third International Conference on Availability, Reliability and Security N2 - We present a process to develop secure software with an extensive pattern-based security requirements engineering phase. It supports identifying and analyzing conflicts between different security requirements. In the design phase, we proceed by selecting security software components that achieve security requirements. The process enables software developers to systematically identify, analyze, and finally realize security requirements using security software components. We illustrate our approach by a lawyer agency software example. KW - security requirement KW - requirements engineering KW - data security KW - computer science Y1 - 2008 UR - https://ieeexplore.ieee.org/document/4529338 SN - 978-0-7695-3102-1 U6 - https://doi.org/10.1109/ARES.2008.27 N1 - Sie haben Zugriff auf den Volltext innerhalb des HSD Campus. SP - 195 EP - 203 PB - IEEE CY - Barcelona ER - TY - CHAP A1 - Schmidt, Holger T1 - Threat- and Risk-Analysis During Early Security Requirements Engineering T2 - 2010 International Conference on Availability, Reliability and Security N2 - We present a threat and risk-driven methodology to security requirements engineering. Our approach has a strong focus on gathering, modeling, and analyzing the environment in which a secure ICT-system to be built is located. The knowledge about the environment comprises threat and risk models. This security-relevant knowledge is used to assess the adequacy of security mechanisms, which are selected to establish security requirements. KW - risk analysis KW - data security KW - security requirements engineering KW - software engineering Y1 - 2010 UR - https://ieeexplore.ieee.org/document/5438095 SN - 978-1-4244-5880-6 U6 - https://doi.org/10.1109/ARES.2010.14 SP - 188 EP - 195 PB - IEEE CY - Krakow ER - TY - CHAP A1 - Schmidt, Holger ED - Massacci, Fabio ED - Redwine Jr., Samuel T. ED - Zannone, Nicola T1 - Pattern-Based Confidentiality-Preserving Refinement T2 - Engineering Secure Software and Systems: First International Symposium ESSoS 2009, Leuven, Belgium, February 4-6, 2009. Proceedings KW - data transmission KW - security requirement KW - problem frame KW - adversary model KW - security requirement engineering Y1 - 2009 UR - https://link.springer.com/chapter/10.1007%2F978-3-642-00199-4_5 SN - 978-3-642-00198-7 U6 - https://doi.org/10.1007/978-3-642-00199-4_5 VL - LNCS, 5429 SP - 43 EP - 59 PB - Springer CY - Berlin, Heidelberg ER -