TY - CHAP A1 - Hatebur, Denis A1 - Heisel, Maritta A1 - Schmidt, Holger ED - Müller, Günter T1 - Security Engineering Using Problem Frames T2 - Emerging Trends in Information and Communication Security: International Conference, ETRICS 2006, Freiburg, Germany, June 6-9, 2006. Proceeding KW - security requirement KW - problem frames KW - security problem KW - security engineering KW - sequence diagram Y1 - 2006 UR - https://link.springer.com/chapter/10.1007/11766155_17 SN - 978-3-540-34640-1 U6 - https://doi.org/10.1007/11766155_17 VL - LNCS, 3995 SP - 238 EP - 253 PB - Springer CY - Berlin, Heidelberg ER - TY - CHAP A1 - Schmidt, Holger A1 - Wentzlaff, Ina ED - Gruhn, Volker ED - Oquendo, Flavio T1 - Preserving Software Quality Characteristics from Requirements Analysis to Architectural Design T2 - Software Architecture: Third European Workshop, EWSA 2006, Nantes, France, September 4-5, 2006, Revised Selected Papers Y1 - 2006 UR - https://link.springer.com/chapter/10.1007/11966104_14 SN - 978-3-540-69271-3 U6 - https://doi.org/10.1007/11966104_14 VL - LNCS, 4344 SP - 189 EP - 203 PB - Springer CY - Berlin, Heidelberg ER - TY - CHAP A1 - Côté, Isabelle A1 - Hatebur, Denis A1 - Heisel, Maritta A1 - Schmidt, Holger A1 - Wentzlaff, Ina T1 - A Systematic Account of Problem Frames T2 - Proceedings of the 12th European Conference on Pattern Languages of Programs (EuroPLoP '2007), Irsee, Germany, July 4-8, 2007. N2 - We give an enumeration of possible problem frames, based on domain characteristics, and comment on the usefulness of the obtained frames. In particular, we investigate problem domains and their characteristics in detail. This leads to fine-grained criteria for describing problem domains. As a result, we identify a new type of problem domain and come up with integrity conditions for developing useful problem frames. Taking a complete enumeration of possible problem frames (with at most three problem domains, of which only one is constrained) as a basis, we find 8 new problem frames, 7 of which we consider as useful in practical software development. KW - problem frames KW - systematic account Y1 - 2008 SP - 749 EP - 767 PB - Universitätsverlag Konstanz CY - Konstanz ER - TY - CHAP A1 - Hatebur, Denis A1 - Heisel, Maritta A1 - Schmidt, Holger T1 - A Security Engineering Process based on Patterns T2 - 18th International Workshop on Database and Expert Systems Applications (DEXA 2007) N2 - We present a security engineering process based on security problem frames and concretized security problem frames. Both kinds of frames constitute patterns for analyzing security problems and associated solution approaches. They are arranged in a pattern system that makes dependencies between them explicit. We describe step-by-step how the pattern system can be used to analyze a given security problem and how solution approaches can be found. Further, we introduce a new frame that focuses on the privacy requirement anonymity. KW - security engineering process KW - pattern system KW - data privacy KW - software development Y1 - 2007 UR - https://ieeexplore.ieee.org/abstract/document/4312991 SN - 978-0-7695-2932-5 U6 - https://doi.org/10.1109/DEXA.2007.36 N1 - Sie haben Zugriff auf den Volltext innerhalb des HSD Campus. SP - 734 EP - 738 PB - IEEE CY - Regensburg ER - TY - CHAP A1 - Beckers, Kristian A1 - Eicker, Stefan A1 - Faßbender, Stephan A1 - Heisel, Maritta A1 - Schmidt, Holger A1 - Schwittek, Widura ED - Quirchmayr, Gerald ED - Basl, Josef ED - You, Ilsun ED - Xu, Lida ED - Weippl, Edgar T1 - Ontology-Based Identification of Research Gaps and Immature Research Areas T2 - Multidisciplinary Research and Practice for Information Systems: IFIP WG 8.4, 8.9/TC 5 International Cross-Domain Conference and Workshop on Availability, Reliability, and Security, CD-ARES 2012, Prague, Czech Republic, August 20-24, 2012. Proceedings KW - business applications KW - data encryption KW - recommender systems KW - software security KW - semantic web Y1 - 2012 UR - https://link.springer.com/chapter/10.1007/978-3-642-32498-7_1 SN - 978-3-642-32497-0 U6 - https://doi.org/10.1007/978-3-642-32498-7_1 SN - 1611-3349 VL - LNCS, 7465 SP - 1 EP - 16 PB - Springer CY - Berlin, Heidelberg ER - TY - CHAP A1 - Beckers, Kristian A1 - Faßbender, Stephan A1 - Heisel, Maritta A1 - Schmidt, Holger T1 - Using Security Requirements Engineering Approaches to Support ISO 27001 Information Security Management Systems Development and Documentation T2 - 2012 Seventh International Conference on Availability, Reliability and Security N2 - An ISO 27001 compliant information security management system is difficult to create, due to the the limited support for system development and documentation provided in the standard. We present a structured analysis of the documentation and development requirements in the ISO 27001 standard. Moreover, we investigate to what extent existing security requirements engineering approaches fulfill these requirements. We developed relations between these approaches and the ISO 27001 standard using a conceptual framework originally developed for comparing security requirements engineering methods. The relations include comparisons of important terms, techniques, and documentation artifacts. In addition, we show practical applications of our results. Y1 - 2012 UR - https://ieeexplore.ieee.org/document/6329189 SN - 978-1-4673-2244-7 U6 - https://doi.org/10.1109/ARES.2012.35 SP - 242 EP - 248 PB - IEEE CY - Prague ER - TY - CHAP A1 - Beckers, Kristian A1 - Faßbender, Stephan A1 - Heisel, Maritta A1 - Küster, Jan-Christoph A1 - Schmidt, Holger ED - Barthe, Gilles ED - Livshits, Benjamin ED - Scandariato, Riccardo T1 - Supporting the Development and Documentation of ISO 27001 Information Security Management Systems through Security Requirements Engineering Approaches T2 - Engineering Secure Software and Systems: 4th International Symposium, ESSoS 2012, Eindhoven, The Netherlands, February, 16-17, 2012. Proceedings KW - Security standards KW - requirements engineering KW - ISO27000 KW - ISO27001 KW - security Y1 - 2012 UR - https://link.springer.com/chapter/10.1007/978-3-642-28166-2_2 SN - 978-3-642-28165-5 U6 - https://doi.org/10.1007/978-3-642-28166-2_2 VL - LNCS, 7159 SP - 14 EP - 21 PB - Springer CY - Berlin, Heidelberg ER - TY - RPRT A1 - Schmidt, Holger A1 - Gondolf, Jeremy A1 - Haufs-Brusberg, Peter T1 - Studie zur Information Security Awareness in kleinen und mittleren Unternehmen (KMU) T1 - Study on Information Security Awareness in Small and Medium-sized Enterprises (SMEs) N2 - Der Bereich der Informationssicherheit stellt große und insbesondere kleine und mittlere Unternehmen (KMU) vor erhebliche Herausforderungen. Zunehmende Angriffe auf IT-Systeme und Infrastrukturen haben die Informationssicherheit zum kritischen Erfolgsfaktor gemacht. Neben klassischen Zielen und Bereichen der Informationssicherheit hat vor allem die Security Awareness - das Sicherheitsbewusstsein aller Mitarbeiter eines Unternehmens - an Bedeutung gewonnen. Security Awareness bezieht sich auf jegliches Wissen und Handeln der Mitarbeiter eines Unternehmens und ist daher ein bedeutsamer Baustein zur ganzheitlichen Gewährleistung von Informationssicherheit. Die Motivation zur Entwicklung und Einführung von Informationssicherheit und insbesondere Security Awareness geht in großen Unternehmen vor allem von externen Faktoren, so z. B. der Regulierung von Branchen, aus und ist mittels globaler Standards, Normen und Frameworks implementiert. KMU sind grundsätzlich keinen geringeren Risiken als große Unternehmen ausgesetzt, verfügen jedoch nur selten über vergleichbare Schutzmaßnahmen hinsichtlich Informationssicherheit. Im Rahmen des Projekts wurden externe Anforderungen für große Unternehmen analysiert und hinsichtlich der Eignung als Grundlage für KMU bewertet. Das Projekt thematisiert weiterhin die Messbarkeit von Security Awareness sowie die in großen Unternehmen eingesetzten Maßnahmen zur Gewährleistung von Security Awareness besonders hinsichtlich ihrer Eignung für KMU. T3 - Berichte zu HSD-intern geförderten Forschungsprojekten - 1 KW - information security KW - awareness KW - sicherheit KW - KMU Y1 - 2018 U6 - http://nbn-resolving.de/urn/resolver.pl?urn:nbn:de:hbz:due62-opus-11880 SN - 2625-3690 PB - Hochschule Düsseldorf CY - Düsseldorf ER - TY - CHAP A1 - Beckers, Kristian A1 - Faßbender, Stephan A1 - Küster, Jan-Christoph A1 - Schmidt, Holger ED - Regnell, Björn ED - Damian, Daniela T1 - A Pattern-Based Method for Identifying and Analyzing Laws T2 - Requirements Engineering: Foundation for Software Quality: 18th International Working Conference, REFSQ 2012, Essen, Germany, March 19-22, 2012. Proceedings KW - compliance KW - law Y1 - 2012 UR - https://link.springer.com/chapter/10.1007/978-3-642-28714-5_23 SN - 978-3-642-28713-8 U6 - https://doi.org/10.1007/978-3-642-28714-5_23 VL - LNCS, 7195 SP - 256 EP - 262 PB - Springer CY - Berlin, Heidelberg ER - TY - CHAP A1 - Schwittek, Widura A1 - Schmidt, Holger A1 - Beckers, Kristian A1 - Eicker, Stefan A1 - Faßbender, Stephan A1 - Heisel, Maritta T1 - A Common Body of Knowledge for Engineering Secure Software and Services T2 - 2012 Seventh International Conference on Availability, Reliability and Security N2 - The discipline of engineering secure software and services brings together researchers and practitioners from software, services, and security engineering. This interdisciplinary community is fairly new, it is still not well integrated and is therefore confronted with differing perspectives, processes, methods, tools, vocabularies, and standards. We present a Common Body of Knowledge (CBK) to overcome the aforementioned problems. We capture use cases from research and practice to derive requirements for the CBK. Our CBK collects, integrates, and structures knowledge from the different disciplines based on an ontology that allows one to semantically enrich content to be able to query the CBK. The CBK heavily relies on user participation, making use of the Semantic MediaWiki as a platform to support collaborative writing. The ontology is complemented by a conceptual framework, consisting of concepts to structure the knowledge and to provide access to it, and a means to build a common terminology. We also present organizational factors covering dissemination and quality assurance. KW - software engineering KW - security engineering KW - services computing KW - common body of knowledge KW - interdisciplinary Y1 - 2012 UR - https://ieeexplore.ieee.org/document/6329223 SN - 978-1-4673-2244-7 U6 - https://doi.org/10.1109/ARES.2012.31 N1 - Sie haben Zugriff auf den Volltext innerhalb des HSD Campus. VL - NESSoS, ICT-2009.1.4 Trustworthy ICT, Grant No. 25698 SP - 499 EP - 506 PB - IEEE CY - Prague ER - TY - CHAP A1 - Beckers, Kristian A1 - Faßbender, Stephan A1 - Schmidt, Holger T1 - An Integrated Method for Pattern-Based Elicitation of Legal Requirements Applied to a Cloud Computing Example T2 - 2012 Seventh International Conference on Availability, Reliability and Security N2 - Considering legal aspects during software development is a challenging problem, due to the cross-disciplinary expertise required. The problem is even more complex for cloud computing systems, because of the international distribution, huge amounts of processed data, and a large number of stakeholders that own or process the data. Approaches exist to deal with parts of the problem, but they are isolated from each other. We present an integrated method for elicitation of legal requirements. A cloud computing online banking scenario illustrates the application of our methods. The running example deals with the problem of storing personal information in the cloud and based upon the BDSG (German Federal Data Protection Act). We describe the structure of the online banking cloud system using an existing pattern-based approach. The elicited information is further refined and processed into functional requirements for software development. Moreover, our method covers the analysis of security-relevant concepts such as assets and attackers particularly with regard to laws. The requirements artifacts then serve as inputs for existing patterns for the identification of laws relevant for the online banking cloud system. Finally, our method helps to systematically derive functional as well as security requirements that realize the previously identified laws. KW - law KW - security KW - requirements engineering KW - software architecture Y1 - 2012 UR - https://ieeexplore.ieee.org/document/6329218 SN - 978-0-7695-4775-6 U6 - https://doi.org/10.1109/ARES.2012.25 N1 - Sie haben Zugriff auf den Volltext innerhalb des HSD Campus. SP - 463 EP - 472 PB - IEEE CY - Prague ER - TY - CHAP A1 - Schmidt, Holger A1 - Hatebur, Denis A1 - Heisel, Maritta ED - Mouratidis, Haralambos T1 - A Pattern-Based Method to Develop Secure Software T2 - Software Engineering for Secure Systems: Industrial and Research Perspectives N2 - The authors present a security engineering process based on security problem frames and concretized security problem frames. Both kinds of frames constitute patterns for analyzing security problems and associated solution approaches. They are arranged in a pattern system that makes dependencies between them explicit. The authors describe step-by-step how the pattern system can be used to analyze a given security problem and how solution approaches can be found. Afterwards, the security problems and the solution approaches are formally modeled in detail. The formal models serve to prove that the solution approaches are correct solutions to the security problems. Furthermore, the formal models of the solution approaches constitute a formal specification of the software to be developed. Then, the specification is implemented by generic security components and generic security architectures, which constitute architectural patterns. Finally, the generic security components and the generic security architecture that composes them are refined and the result is a secure software product built from existing and/or tailor-made security components. KW - security KW - problems Y1 - 2011 SN - 978-1-61520-837-1 U6 - https://doi.org/10.4018/978-1-61520-837-1.ch003 SP - 32 EP - 74 PB - IGI Global CY - Hershey ER - TY - CHAP A1 - Jürjens, Jan A1 - Ochoa, Martín A1 - Schmidt, Holger A1 - Marchal, Loïc A1 - Houmb, Siv Hilde A1 - Islam, Shareeful ED - Bernardo, Marco ED - Issarny, Valérie T1 - Modelling Secure Systems Evolution: Abstract and Concrete Change Specifications T2 - Formal Methods for Eternal Networked Software Systems: 11th International School on Formal Methods for the Design of Computer, Communication and Software Systems, SFM 2011, Bertinoro, Italy, June 13-18, 2011. Advanced Lectures N2 - Developing security-critical systems is difficult, and there are many well-known examples of vulnerabilities exploited in practice. In fact, there has recently been a lot of work on methods, techniques, and tools to improve this situation already at the system specification and design. However, security-critical systems are increasingly long-living and undergo evolution throughout their lifetime. Therefore, a secure software development approach that supports maintaining the needed levels of security even through later software evolution is highly desirable. In this chapter, we recall the UMLsec approach to model-based security and discuss on tools and techniques to model and verify evolution of UMLsec models. KW - software evolution KW - UMLsec KW - UMLseCH KW - security Y1 - 2011 UR - https://link.springer.com/chapter/10.1007/978-3-642-21455-4_15 SN - 978-3-642-21455-4 U6 - https://doi.org/10.1007/978-3-642-21455-4_15 VL - LNCS, 6659 SP - 504 EP - 526 PB - Springer CY - Berlin, Heidelberg ER - TY - JOUR A1 - Schmidt, Holger T1 - Threat and Risk-Driven Security Requirements Engineering JF - International Journal of Mobile Computing and Multimedia Communications N2 - In this paper, the author aim to present a threat and risk-driven methodology to security requirements engineering. The chosen approach has a strong focus on gathering, modeling, and analyzing the environment in which a secure ICT-system to be built is located. The knowledge about the environment comprises threat and risk models. As presented in the paper, this security-relevant knowledge is used to assess the adequacy of security mechanisms, which are then selected to establish security requirements. KW - security KW - security engineering Y1 - 2011 U6 - https://doi.org/10.4018/jmcmc.2011010103 SN - 1937-9412 VL - 3 IS - 1 SP - 35 EP - 50 PB - IGI Global ER - TY - RPRT A1 - Schmidt, Holger A1 - Jürjens, Jan T1 - UMLsec4UML2 - Adopting UMLsec to Support UML2 T2 - LS 14 Software Engineering mit dem Schwerpunkt Entwicklung evolutionsfähiger Software und Systeme N2 - In this paper, we present an approach to adopt UMLsec, which is defined for UML 1.5, to support the current UML version 2.3. The new profile UMLsec4UML2 is technically constructed as a UML profile diagram, which is equipped with a number of integrity conditions expressed using OCL. Consequently, the UMLsec4UML2-profile can be loaded in any Eclipse-based EMF- and MDT-compatible UML editing tool to develop and analyze different kinds of security models. The OCL constraints replace the static checks of the tool support for the old UMLsec defined for UML 1.5. Thus, the UMLsec4UML2-profile not only provides the whole expresiveness of UML2.3 for security modeling, it also brings considerably more freedom in selecting a basic UML editing tool, and it integrates modeling and analyzing security models. Since UML2.3 comprises new diagram types, as well as new model elements and new semantics of diagram types already contained in UML1.5, we consider a number of these changes in detail. More specifically, we consider composite structure and sequence diagrams with respect to modeling security properties according to the original version of UMLsec. The goal is to use UMLsec4UML2 to specify architectural security patterns. KW - UMLsec KW - UML2 KW - OCL KW - security architecture KW - security pattern Y1 - 2011 UR - https://eldorado.tu-dortmund.de/handle/2003/27602?locale=de U6 - https://doi.org/10.17877/DE290R-990 N1 - Der Bericht kann über die angebenen URL aufgerufen werden. PB - Technische Hochschule Dortmund CY - Dortmund ER - TY - CHAP A1 - Heyman, Thomas A1 - Yskout, Koen A1 - Scandariato, Riccardo A1 - Schmidt, Holger A1 - Yu, Yijun ED - Erlingsson, Úlfar ED - Wieringa, Roel ED - Zannone, Nicola T1 - The Security Twin Peaks T2 - Engineering Secure Software and Systems: Third International Symposium, ESSoS 2011, Madrid, Spain, February 9-10, 2011. Proceedings KW - security KW - software architecture KW - requirements KW - patterns Y1 - 2011 UR - https://link.springer.com/book/10.1007/978-3-642-19125-1 SN - 978-3-642-19124-4 U6 - https://doi.org/10.1007/978-3-642-19125-1_13 VL - LNCS IS - 6542 SP - 167 EP - 180 PB - Springer CY - Berlin, Heidelberg ER - TY - CHAP A1 - Hatebur, Denis A1 - Heisel, Maritta A1 - Jürjens, Jan A1 - Schmidt, Holger ED - Giannakopoulou, Dimitra ED - Orejas, Fernando T1 - Systematic Development of UMLsec Design Models Based on Security Requirements T2 - Fundamental Approaches to Software Engineering: 14th International Conference, FASE 2011, Held as Part of the Joint European Conferences on Theory and Practice of Software, ETAPS 2011, Saarbrücken, Germany, March 26–April 3, 2011. Proceedings KW - security requirement KW - secquence diagram KW - eclipse modeling framework KW - patient monitoring system KW - security requirement engineering Y1 - 2011 UR - https://link.springer.com/chapter/10.1007/978-3-642-19811-3_17 SN - 978-3-642-19810-6 U6 - https://doi.org/10.1007/978-3-642-19811-3_17 VL - LNCS, 6603 SP - 232 EP - 246 PB - Springer CY - Berlin, Heidelberg ER - TY - CHAP A1 - Schmidt, Holger A1 - Jürjens, Jan ED - Mouratidis, Haralambos ED - Rolland, Colette T1 - Connecting Security Requirements Analysis and Secure Design Using Patterns and UMLsec T2 - Advanced Information Systems Engineering: 23rd International Conference, CAiSE 2011, London, UK, June 20-24, 2011. Proceedings KW - security requirement KW - secure design KW - architectual pattern Y1 - 2011 UR - https://link.springer.com/chapter/10.1007/978-3-642-21640-4_28 SN - 978-3-642-21639-8 U6 - https://doi.org/10.1007/978-3-642-21640-4_28 VL - LNCS, 6741 SP - 367 EP - 382 PB - Springer CY - Berlin, Heidelberg ER - TY - CHAP A1 - Jürjens, Jan A1 - Marchal, Loïc A1 - Ochoa, Martín A1 - Schmidt, Holger ED - France, Robert B. ED - Kuester, Jochen M. ED - Bordbar, Behzad ED - Paige, Richard F. T1 - Incremental Security Verification for Evolving UMLsec models T2 - Modelling Foundations and Applications: 7th European Conference, ECMFA 2011, Birmingham, UK, June 6 - 9, 2011 Proceedings KW - model element KW - security requirement KW - class diagram KW - evolution path KW - security property Y1 - 2011 UR - https://link.springer.com/chapter/10.1007/978-3-642-21470-7_5 SN - 978-3-642-21469-1 U6 - https://doi.org/10.1007/978-3-642-21470-7_5 VL - LNCS, 6698 SP - 52 EP - 68 PB - Springer CY - Berlin, Heidelberg ER - TY - CHAP A1 - Beckers, Kristian A1 - Schmidt, Holger A1 - Küster, Jan-Christoph A1 - Faßbender, Stephan T1 - Pattern-Based Support for Context Establishment and Asset Identification of the ISO 27000 in the Field of Cloud Computing T2 - 2011 Sixth International Conference on Availability, Reliability and Security N2 - The ISO 27000 is a well-established series of information security standards. The scope for applying these standards can be an organisation as a whole, single business processes or even an IT application or IT infrastructure. The context establishment and the asset identification are among the first steps to be performed. The quality of the results produced when performing these steps has a crucial influence on the subsequent steps such as identifying loss, vulnerabilities, possible attacks and defining countermeasures. Thus, a context analysis to gather all necessary information in the initial steps is important, but is not offered in the standard. In this paper, we focus on the scope of cloud computing systems and present a way to support the context establishment and the asset identification described in ISO 27005. A cloud system analysis pattern and different kinds of stakeholder templates serve to understand and describe a given cloud development problem, i.e. the envisaged IT systems and the relevant parts of the operational environment. We illustrate our support using an online banking cloud scenario. KW - security standards KW - IT infrastructure KW - ISO27005 KW - Cloud computing KW - risk management Y1 - 2011 UR - https://ieeexplore.ieee.org/document/6045958 SN - 978-1-4577-0979-1 U6 - https://doi.org/10.1109/ARES.2011.55 N1 - Sie haben Zugriff auf den Volltext innerhalb des HSD Campus. SP - 327 EP - 333 PB - IEEE CY - Vienna ER -