TY - CHAP A1 - Glowatz, Christoph A1 - Haufs-Brusberg, Peter A1 - Schmidt, Holger ED - Schulz, Thomas T1 - Unternehmensorganisation und Informationssicherheit: Einführung und Grundlagen (Kap. F1) T2 - Cybersicherheit für vernetzte Anwendungen in der Industrie 4.0 Y1 - 2019 SN - 978-3834334244 SP - 315 EP - 334 PB - Vogel Communications Group CY - Würzburg ER - TY - CHAP A1 - Schmidt, Holger A1 - Hatebur, Denis A1 - Heisel, Maritta T1 - Developing Secure Software Using UML Patterns T2 - Intelligent systems: Concepts, methodologies, tools, and applications Y1 - 2018 SN - 9781522556435 U6 - https://doi.org/10.4018/978-1-5225-5643-5.ch022 SP - 551 EP - 592 PB - IGI Global CY - Hershey, Pennsylvania ER - TY - CHAP A1 - Glowatz, Christoph A1 - Haufs-Brusberg, Peter A1 - Schmidt, Holger ED - Schulz, Thomas T1 - Unternehmensorganisation und Informationssicherheit – Einführung und Grundlagen T2 - Cybersicherheit für vernetzte Anwendungen in der Industrie 4.0 Y1 - 2020 SN - 978-3-8343-3424-4 SP - 315 EP - 334 PB - Vogel Communications Group CY - Würzburg ER - TY - CHAP A1 - van Aerssen, Max A1 - Leich, Christian A1 - Schmidt, Holger A1 - Al Ali, Salar A1 - Benni, Abdulkader A1 - Tanz, Jakob T1 - CopypastaVulGuard - A browser extension to prevent copy and paste spreading of vulnerable source code in forum posts T2 - ARES '22: Proceedings of the 17th International Conference on Availability, Reliability and Security N2 - Forums such as Stack Overflow are used by many software developers to find a solution for a given coding problem. Found solutions, i.e. forum posts containing relevant source code, are utilized in a copy and paste manner. This behavior carries the risk that vulnerabilities contained in the source code of the forum posts are spread. Software developers should be able to identify vulnerable source code at an early stage, thereby preventing copying the corresponding source code. In this paper, we introduce the tool CopypastaVulGuard that identifies vulnerable source code in forum posts and allows software developers to omit the source code by marking the forum posts as dangerous. Our tool consists of a browser extension and a management application capable to address as examples SQL injections, remote code executions and deprecated functions based on a dump of the archive.org Stack Overflow data set. We present an evaluation of our tool's possible impact and relevance considering pros/cons and selected research questions. Y1 - 2022 U6 - https://doi.org/10.1145/3538969.3538973 SP - 1 EP - 8 PB - Association for Computing Machinery CY - New York ER - TY - RPRT A1 - Schmidt, Holger A1 - Gondolf, Jeremy A1 - Haufs-Brusberg, Peter T1 - Studie zur Information Security Awareness in kleinen und mittleren Unternehmen (KMU) N2 - Der Bereich der Informationssicherheit stellt große und insbesondere kleine und mittlere Unternehmen (KMU) vor erhebliche Herausforderungen. Zunehmende Angriffe auf IT-Systeme und Infrastrukturen haben die Informationssicherheit zum kritischen Erfolgsfaktor gemacht. Neben klassischen Zielen und Bereichen der Informationssicherheit hat vor allem die Security Awareness - das Sicherheitsbewusstsein aller Mitarbeiter eines Unternehmens - an Bedeutung gewonnen. Security Awareness bezieht sich auf jegliches Wissen und Handeln der Mitarbeiter eines Unternehmens und ist daher ein bedeutsamer Baustein zur ganzheitlichen Gewährleistung von Informationssicherheit. Die Motivation zur Entwicklung und Einführung von Informationssicherheit und insbesondere Security Awareness geht in großen Unternehmen vor allem von externen Faktoren, so z. B. der Regulierung von Branchen, aus und ist mittels globaler Standards, Normen und Frameworks implementiert. KMU sind grundsätzlich keinen geringeren Risiken als große Unternehmen ausgesetzt, verfügen jedoch nur selten über vergleichbare Schutzmaßnahmen hinsichtlich Informationssicherheit. Im Rahmen des Projekts wurden externe Anforderungen für große Unternehmen analysiert und hinsichtlich der Eignung als Grundlage für KMU bewertet. Das Projekt thematisiert weiterhin die Messbarkeit von Security Awareness sowie die in großen Unternehmen eingesetzten Maßnahmen zur Gewährleistung von Security Awareness besonders hinsichtlich ihrer Eignung für KMU. T2 - Study on Information Security Awareness in Small and Medium-sized Enterprises (SMEs) T3 - Berichte zu HSD-intern geförderten Forschungsprojekten - 1 KW - information security KW - awareness KW - sicherheit KW - KMU Y1 - 2018 U6 - http://nbn-resolving.de/urn/resolver.pl?urn:nbn:de:hbz:due62-opus-11880 SN - 2625-3690 PB - Hochschule Düsseldorf CY - Düsseldorf ER - TY - CHAP A1 - Beckers, Kristian A1 - Eicker, Stefan A1 - Faßbender, Stephan A1 - Heisel, Maritta A1 - Schmidt, Holger A1 - Schwittek, Widura ED - Quirchmayr, Gerald ED - Basl, Josef ED - You, Ilsun ED - Xu, Lida ED - Weippl, Edgar T1 - Ontology-Based Identification of Research Gaps and Immature Research Areas T2 - Multidisciplinary Research and Practice for Information Systems: IFIP WG 8.4, 8.9/TC 5 International Cross-Domain Conference and Workshop on Availability, Reliability, and Security, CD-ARES 2012, Prague, Czech Republic, August 20-24, 2012. Proceedings KW - business applications KW - data encryption KW - recommender systems KW - software security KW - semantic web Y1 - 2012 UR - https://link.springer.com/chapter/10.1007/978-3-642-32498-7_1 SN - 978-3-642-32497-0 U6 - https://doi.org/10.1007/978-3-642-32498-7_1 SN - 1611-3349 VL - LNCS, 7465 SP - 1 EP - 16 PB - Springer CY - Berlin, Heidelberg ER - TY - CHAP A1 - Beckers, Kristian A1 - Faßbender, Stephan A1 - Heisel, Maritta A1 - Schmidt, Holger T1 - Using Security Requirements Engineering Approaches to Support ISO 27001 Information Security Management Systems Development and Documentation T2 - 2012 Seventh International Conference on Availability, Reliability and Security N2 - An ISO 27001 compliant information security management system is difficult to create, due to the the limited support for system development and documentation provided in the standard. We present a structured analysis of the documentation and development requirements in the ISO 27001 standard. Moreover, we investigate to what extent existing security requirements engineering approaches fulfill these requirements. We developed relations between these approaches and the ISO 27001 standard using a conceptual framework originally developed for comparing security requirements engineering methods. The relations include comparisons of important terms, techniques, and documentation artifacts. In addition, we show practical applications of our results. Y1 - 2012 UR - https://ieeexplore.ieee.org/document/6329189 SN - 978-1-4673-2244-7 U6 - https://doi.org/10.1109/ARES.2012.35 SP - 242 EP - 248 PB - IEEE CY - Prague ER - TY - CHAP A1 - Beckers, Kristian A1 - Faßbender, Stephan A1 - Heisel, Maritta A1 - Küster, Jan-Christoph A1 - Schmidt, Holger ED - Barthe, Gilles ED - Livshits, Benjamin ED - Scandariato, Riccardo T1 - Supporting the Development and Documentation of ISO 27001 Information Security Management Systems through Security Requirements Engineering Approaches T2 - Engineering Secure Software and Systems: 4th International Symposium, ESSoS 2012, Eindhoven, The Netherlands, February, 16-17, 2012. Proceedings KW - Security standards KW - requirements engineering KW - ISO27000 KW - ISO27001 KW - security Y1 - 2012 UR - https://link.springer.com/chapter/10.1007/978-3-642-28166-2_2 SN - 978-3-642-28165-5 U6 - https://doi.org/10.1007/978-3-642-28166-2_2 VL - LNCS, 7159 SP - 14 EP - 21 PB - Springer CY - Berlin, Heidelberg ER - TY - CHAP A1 - Beckers, Kristian A1 - Faßbender, Stephan A1 - Küster, Jan-Christoph A1 - Schmidt, Holger ED - Regnell, Björn ED - Damian, Daniela T1 - A Pattern-Based Method for Identifying and Analyzing Laws T2 - Requirements Engineering: Foundation for Software Quality: 18th International Working Conference, REFSQ 2012, Essen, Germany, March 19-22, 2012. Proceedings KW - compliance KW - law Y1 - 2012 UR - https://link.springer.com/chapter/10.1007/978-3-642-28714-5_23 SN - 978-3-642-28713-8 U6 - https://doi.org/10.1007/978-3-642-28714-5_23 VL - LNCS, 7195 SP - 256 EP - 262 PB - Springer CY - Berlin, Heidelberg ER - TY - CHAP A1 - Schwittek, Widura A1 - Schmidt, Holger A1 - Beckers, Kristian A1 - Eicker, Stefan A1 - Faßbender, Stephan A1 - Heisel, Maritta T1 - A Common Body of Knowledge for Engineering Secure Software and Services T2 - 2012 Seventh International Conference on Availability, Reliability and Security N2 - The discipline of engineering secure software and services brings together researchers and practitioners from software, services, and security engineering. This interdisciplinary community is fairly new, it is still not well integrated and is therefore confronted with differing perspectives, processes, methods, tools, vocabularies, and standards. We present a Common Body of Knowledge (CBK) to overcome the aforementioned problems. We capture use cases from research and practice to derive requirements for the CBK. Our CBK collects, integrates, and structures knowledge from the different disciplines based on an ontology that allows one to semantically enrich content to be able to query the CBK. The CBK heavily relies on user participation, making use of the Semantic MediaWiki as a platform to support collaborative writing. The ontology is complemented by a conceptual framework, consisting of concepts to structure the knowledge and to provide access to it, and a means to build a common terminology. We also present organizational factors covering dissemination and quality assurance. KW - software engineering KW - security engineering KW - services computing KW - common body of knowledge KW - interdisciplinary Y1 - 2012 UR - https://ieeexplore.ieee.org/document/6329223 SN - 978-1-4673-2244-7 U6 - https://doi.org/10.1109/ARES.2012.31 N1 - Sie haben Zugriff auf den Volltext innerhalb des HSD Campus. VL - NESSoS, ICT-2009.1.4 Trustworthy ICT, Grant No. 25698 SP - 499 EP - 506 PB - IEEE CY - Prague ER -