TY - CHAP A1 - Schwittek, Widura A1 - Schmidt, Holger A1 - Eicker, Stefan A1 - Heisel, Maritta ED - Filipe, Joaquim ED - Liu, Kecheng T1 - Towards a Common Body of Knowledge for Engineering Secure Software and Services T2 - Proceedings of the International Conference on Knowledge Management and Information Sharing N2 - Interdisciplinary communities involve people and knowledge from different disciplines in addressing a common challenge. Differing perspectives, processes, methods, tools, vocabularies, and standards are problems that arise in this context. We present an approach to support bringing together disciplines based on a common body of knowledge (CBK), in which knowledge from different disciplines is collected, integrated, and structured. The novelty of our approach is twofold: first, it introduces a CBK ontology, which allows one to semantically enrich contents in order to be able to query the CBK in a more elaborate way afterwards. Second, it heavily relies on user participation in building up a CBK, making use of the Semantic MediaWiki as a platform to support collaborative writing. The CBK ontology is backed by a conceptual framework, consisting of concepts to structure the knowledge, to provide access options to it, and to build up a common terminology. To ensure a high quality of the provided contents and to sustain the community’s commitment, we further present organizational means as part of our approach. We demonstrate our work using the example of a Network of Excellence EU project, which aims at bringing together researchers and practitioners from services computing, security and software engineering. KW - common body of knowledge KW - knowledge management KW - software engineering KW - security engineering KW - services computing Y1 - 2011 SP - 369 EP - 374 PB - SciTePress - Science and Technology Publications CY - Paris ER - TY - CHAP A1 - Côté, Isabelle A1 - Heisel, Maritta A1 - Schmidt, Holger A1 - Hatebur, Denis T1 - UML4PF — A tool for problem-oriented requirements analysis T2 - 2011 IEEE 19th International Requirements Engineering Conference N2 - We present UML4PF, a tool for requirements analysis based on problem frames. It consists of a UML profile and an Eclipse-Plugin to model and analyze problem diagrams, derive specifications, and develop architectures. KW - Unified modeling language KW - problem frames KW - tool support KW - programming KW - generators Y1 - 2011 UR - https://ieeexplore.ieee.org/document/6051670 SN - 978-1-4577-0924-1 U6 - https://doi.org/10.1109/RE.2011.6051670 N1 - Sie haben Zugriff auf den Volltext innerhalb des HSD Campus. SP - 349 EP - 350 PB - IEEE CY - Trento ER - TY - CHAP A1 - Beckers, Kristian A1 - Schmidt, Holger A1 - Küster, Jan-Christoph A1 - Faßbender, Stephan T1 - Pattern-Based Support for Context Establishment and Asset Identification of the ISO 27000 in the Field of Cloud Computing T2 - 2011 Sixth International Conference on Availability, Reliability and Security N2 - The ISO 27000 is a well-established series of information security standards. The scope for applying these standards can be an organisation as a whole, single business processes or even an IT application or IT infrastructure. The context establishment and the asset identification are among the first steps to be performed. The quality of the results produced when performing these steps has a crucial influence on the subsequent steps such as identifying loss, vulnerabilities, possible attacks and defining countermeasures. Thus, a context analysis to gather all necessary information in the initial steps is important, but is not offered in the standard. In this paper, we focus on the scope of cloud computing systems and present a way to support the context establishment and the asset identification described in ISO 27005. A cloud system analysis pattern and different kinds of stakeholder templates serve to understand and describe a given cloud development problem, i.e. the envisaged IT systems and the relevant parts of the operational environment. We illustrate our support using an online banking cloud scenario. KW - security standards KW - IT infrastructure KW - ISO27005 KW - Cloud computing KW - risk management Y1 - 2011 UR - https://ieeexplore.ieee.org/document/6045958 SN - 978-1-4577-0979-1 U6 - https://doi.org/10.1109/ARES.2011.55 N1 - Sie haben Zugriff auf den Volltext innerhalb des HSD Campus. SP - 327 EP - 333 PB - IEEE CY - Vienna ER - TY - CHAP A1 - Schmidt, Holger A1 - Jürjens, Jan ED - Mouratidis, Haralambos ED - Rolland, Colette T1 - Connecting Security Requirements Analysis and Secure Design Using Patterns and UMLsec T2 - Advanced Information Systems Engineering: 23rd International Conference, CAiSE 2011, London, UK, June 20-24, 2011. Proceedings KW - security requirement KW - secure design KW - architectual pattern Y1 - 2011 UR - https://link.springer.com/chapter/10.1007/978-3-642-21640-4_28 SN - 978-3-642-21639-8 U6 - https://doi.org/10.1007/978-3-642-21640-4_28 VL - LNCS, 6741 SP - 367 EP - 382 PB - Springer CY - Berlin, Heidelberg ER - TY - CHAP A1 - Jürjens, Jan A1 - Marchal, Loïc A1 - Ochoa, Martín A1 - Schmidt, Holger ED - France, Robert B. ED - Kuester, Jochen M. ED - Bordbar, Behzad ED - Paige, Richard F. T1 - Incremental Security Verification for Evolving UMLsec models T2 - Modelling Foundations and Applications: 7th European Conference, ECMFA 2011, Birmingham, UK, June 6 - 9, 2011 Proceedings KW - model element KW - security requirement KW - class diagram KW - evolution path KW - security property Y1 - 2011 UR - https://link.springer.com/chapter/10.1007/978-3-642-21470-7_5 SN - 978-3-642-21469-1 U6 - https://doi.org/10.1007/978-3-642-21470-7_5 VL - LNCS, 6698 SP - 52 EP - 68 PB - Springer CY - Berlin, Heidelberg ER - TY - CHAP A1 - Hatebur, Denis A1 - Heisel, Maritta A1 - Jürjens, Jan A1 - Schmidt, Holger ED - Giannakopoulou, Dimitra ED - Orejas, Fernando T1 - Systematic Development of UMLsec Design Models Based on Security Requirements T2 - Fundamental Approaches to Software Engineering: 14th International Conference, FASE 2011, Held as Part of the Joint European Conferences on Theory and Practice of Software, ETAPS 2011, Saarbrücken, Germany, March 26–April 3, 2011. Proceedings KW - security requirement KW - secquence diagram KW - eclipse modeling framework KW - patient monitoring system KW - security requirement engineering Y1 - 2011 UR - https://link.springer.com/chapter/10.1007/978-3-642-19811-3_17 SN - 978-3-642-19810-6 U6 - https://doi.org/10.1007/978-3-642-19811-3_17 VL - LNCS, 6603 SP - 232 EP - 246 PB - Springer CY - Berlin, Heidelberg ER - TY - CHAP A1 - Heyman, Thomas A1 - Yskout, Koen A1 - Scandariato, Riccardo A1 - Schmidt, Holger A1 - Yu, Yijun ED - Erlingsson, Úlfar ED - Wieringa, Roel ED - Zannone, Nicola T1 - The Security Twin Peaks T2 - Engineering Secure Software and Systems: Third International Symposium, ESSoS 2011, Madrid, Spain, February 9-10, 2011. Proceedings KW - security KW - software architecture KW - requirements KW - patterns Y1 - 2011 UR - https://link.springer.com/book/10.1007/978-3-642-19125-1 SN - 978-3-642-19124-4 U6 - https://doi.org/10.1007/978-3-642-19125-1_13 VL - LNCS IS - 6542 SP - 167 EP - 180 PB - Springer CY - Berlin, Heidelberg ER - TY - CHAP A1 - Jürjens, Jan A1 - Ochoa, Martín A1 - Schmidt, Holger A1 - Marchal, Loïc A1 - Houmb, Siv Hilde A1 - Islam, Shareeful ED - Bernardo, Marco ED - Issarny, Valérie T1 - Modelling Secure Systems Evolution: Abstract and Concrete Change Specifications T2 - Formal Methods for Eternal Networked Software Systems: 11th International School on Formal Methods for the Design of Computer, Communication and Software Systems, SFM 2011, Bertinoro, Italy, June 13-18, 2011. Advanced Lectures N2 - Developing security-critical systems is difficult, and there are many well-known examples of vulnerabilities exploited in practice. In fact, there has recently been a lot of work on methods, techniques, and tools to improve this situation already at the system specification and design. However, security-critical systems are increasingly long-living and undergo evolution throughout their lifetime. Therefore, a secure software development approach that supports maintaining the needed levels of security even through later software evolution is highly desirable. In this chapter, we recall the UMLsec approach to model-based security and discuss on tools and techniques to model and verify evolution of UMLsec models. KW - software evolution KW - UMLsec KW - UMLseCH KW - security Y1 - 2011 UR - https://link.springer.com/chapter/10.1007/978-3-642-21455-4_15 SN - 978-3-642-21455-4 U6 - https://doi.org/10.1007/978-3-642-21455-4_15 VL - LNCS, 6659 SP - 504 EP - 526 PB - Springer CY - Berlin, Heidelberg ER - TY - CHAP A1 - Beckers, Kristian A1 - Faßbender, Stephan A1 - Schmidt, Holger T1 - An Integrated Method for Pattern-Based Elicitation of Legal Requirements Applied to a Cloud Computing Example T2 - 2012 Seventh International Conference on Availability, Reliability and Security N2 - Considering legal aspects during software development is a challenging problem, due to the cross-disciplinary expertise required. The problem is even more complex for cloud computing systems, because of the international distribution, huge amounts of processed data, and a large number of stakeholders that own or process the data. Approaches exist to deal with parts of the problem, but they are isolated from each other. We present an integrated method for elicitation of legal requirements. A cloud computing online banking scenario illustrates the application of our methods. The running example deals with the problem of storing personal information in the cloud and based upon the BDSG (German Federal Data Protection Act). We describe the structure of the online banking cloud system using an existing pattern-based approach. The elicited information is further refined and processed into functional requirements for software development. Moreover, our method covers the analysis of security-relevant concepts such as assets and attackers particularly with regard to laws. The requirements artifacts then serve as inputs for existing patterns for the identification of laws relevant for the online banking cloud system. Finally, our method helps to systematically derive functional as well as security requirements that realize the previously identified laws. KW - law KW - security KW - requirements engineering KW - software architecture Y1 - 2012 UR - https://ieeexplore.ieee.org/document/6329218 SN - 978-0-7695-4775-6 U6 - https://doi.org/10.1109/ARES.2012.25 N1 - Sie haben Zugriff auf den Volltext innerhalb des HSD Campus. SP - 463 EP - 472 PB - IEEE CY - Prague ER - TY - CHAP A1 - Schwittek, Widura A1 - Schmidt, Holger A1 - Beckers, Kristian A1 - Eicker, Stefan A1 - Faßbender, Stephan A1 - Heisel, Maritta T1 - A Common Body of Knowledge for Engineering Secure Software and Services T2 - 2012 Seventh International Conference on Availability, Reliability and Security N2 - The discipline of engineering secure software and services brings together researchers and practitioners from software, services, and security engineering. This interdisciplinary community is fairly new, it is still not well integrated and is therefore confronted with differing perspectives, processes, methods, tools, vocabularies, and standards. We present a Common Body of Knowledge (CBK) to overcome the aforementioned problems. We capture use cases from research and practice to derive requirements for the CBK. Our CBK collects, integrates, and structures knowledge from the different disciplines based on an ontology that allows one to semantically enrich content to be able to query the CBK. The CBK heavily relies on user participation, making use of the Semantic MediaWiki as a platform to support collaborative writing. The ontology is complemented by a conceptual framework, consisting of concepts to structure the knowledge and to provide access to it, and a means to build a common terminology. We also present organizational factors covering dissemination and quality assurance. KW - software engineering KW - security engineering KW - services computing KW - common body of knowledge KW - interdisciplinary Y1 - 2012 UR - https://ieeexplore.ieee.org/document/6329223 SN - 978-1-4673-2244-7 U6 - https://doi.org/10.1109/ARES.2012.31 N1 - Sie haben Zugriff auf den Volltext innerhalb des HSD Campus. VL - NESSoS, ICT-2009.1.4 Trustworthy ICT, Grant No. 25698 SP - 499 EP - 506 PB - IEEE CY - Prague ER - TY - CHAP A1 - Beckers, Kristian A1 - Faßbender, Stephan A1 - Küster, Jan-Christoph A1 - Schmidt, Holger ED - Regnell, Björn ED - Damian, Daniela T1 - A Pattern-Based Method for Identifying and Analyzing Laws T2 - Requirements Engineering: Foundation for Software Quality: 18th International Working Conference, REFSQ 2012, Essen, Germany, March 19-22, 2012. Proceedings KW - compliance KW - law Y1 - 2012 UR - https://link.springer.com/chapter/10.1007/978-3-642-28714-5_23 SN - 978-3-642-28713-8 U6 - https://doi.org/10.1007/978-3-642-28714-5_23 VL - LNCS, 7195 SP - 256 EP - 262 PB - Springer CY - Berlin, Heidelberg ER - TY - CHAP A1 - Beckers, Kristian A1 - Faßbender, Stephan A1 - Heisel, Maritta A1 - Küster, Jan-Christoph A1 - Schmidt, Holger ED - Barthe, Gilles ED - Livshits, Benjamin ED - Scandariato, Riccardo T1 - Supporting the Development and Documentation of ISO 27001 Information Security Management Systems through Security Requirements Engineering Approaches T2 - Engineering Secure Software and Systems: 4th International Symposium, ESSoS 2012, Eindhoven, The Netherlands, February, 16-17, 2012. Proceedings KW - Security standards KW - requirements engineering KW - ISO27000 KW - ISO27001 KW - security Y1 - 2012 UR - https://link.springer.com/chapter/10.1007/978-3-642-28166-2_2 SN - 978-3-642-28165-5 U6 - https://doi.org/10.1007/978-3-642-28166-2_2 VL - LNCS, 7159 SP - 14 EP - 21 PB - Springer CY - Berlin, Heidelberg ER - TY - CHAP A1 - Beckers, Kristian A1 - Faßbender, Stephan A1 - Heisel, Maritta A1 - Schmidt, Holger T1 - Using Security Requirements Engineering Approaches to Support ISO 27001 Information Security Management Systems Development and Documentation T2 - 2012 Seventh International Conference on Availability, Reliability and Security N2 - An ISO 27001 compliant information security management system is difficult to create, due to the the limited support for system development and documentation provided in the standard. We present a structured analysis of the documentation and development requirements in the ISO 27001 standard. Moreover, we investigate to what extent existing security requirements engineering approaches fulfill these requirements. We developed relations between these approaches and the ISO 27001 standard using a conceptual framework originally developed for comparing security requirements engineering methods. The relations include comparisons of important terms, techniques, and documentation artifacts. In addition, we show practical applications of our results. Y1 - 2012 UR - https://ieeexplore.ieee.org/document/6329189 SN - 978-1-4673-2244-7 U6 - https://doi.org/10.1109/ARES.2012.35 SP - 242 EP - 248 PB - IEEE CY - Prague ER - TY - CHAP A1 - Beckers, Kristian A1 - Eicker, Stefan A1 - Faßbender, Stephan A1 - Heisel, Maritta A1 - Schmidt, Holger A1 - Schwittek, Widura ED - Quirchmayr, Gerald ED - Basl, Josef ED - You, Ilsun ED - Xu, Lida ED - Weippl, Edgar T1 - Ontology-Based Identification of Research Gaps and Immature Research Areas T2 - Multidisciplinary Research and Practice for Information Systems: IFIP WG 8.4, 8.9/TC 5 International Cross-Domain Conference and Workshop on Availability, Reliability, and Security, CD-ARES 2012, Prague, Czech Republic, August 20-24, 2012. Proceedings KW - business applications KW - data encryption KW - recommender systems KW - software security KW - semantic web Y1 - 2012 UR - https://link.springer.com/chapter/10.1007/978-3-642-32498-7_1 SN - 978-3-642-32497-0 U6 - https://doi.org/10.1007/978-3-642-32498-7_1 SN - 1611-3349 VL - LNCS, 7465 SP - 1 EP - 16 PB - Springer CY - Berlin, Heidelberg ER -