TY - CHAP A1 - Schmidt, Holger A1 - Hatebur, Denis A1 - Heisel, Maritta T1 - Developing Secure Software Using UML Patterns T2 - Intelligent systems: Concepts, methodologies, tools, and applications Y1 - 2018 SN - 9781522556435 U6 - https://doi.org/10.4018/978-1-5225-5643-5.ch022 SP - 551 EP - 592 PB - IGI Global CY - Hershey, Pennsylvania ER - TY - CHAP A1 - Beckers, Kristian A1 - Eicker, Stefan A1 - Faßbender, Stephan A1 - Heisel, Maritta A1 - Schmidt, Holger A1 - Schwittek, Widura ED - Quirchmayr, Gerald ED - Basl, Josef ED - You, Ilsun ED - Xu, Lida ED - Weippl, Edgar T1 - Ontology-Based Identification of Research Gaps and Immature Research Areas T2 - Multidisciplinary Research and Practice for Information Systems: IFIP WG 8.4, 8.9/TC 5 International Cross-Domain Conference and Workshop on Availability, Reliability, and Security, CD-ARES 2012, Prague, Czech Republic, August 20-24, 2012. Proceedings KW - business applications KW - data encryption KW - recommender systems KW - software security KW - semantic web Y1 - 2012 UR - https://link.springer.com/chapter/10.1007/978-3-642-32498-7_1 SN - 978-3-642-32497-0 U6 - https://doi.org/10.1007/978-3-642-32498-7_1 SN - 1611-3349 VL - LNCS, 7465 SP - 1 EP - 16 PB - Springer CY - Berlin, Heidelberg ER - TY - CHAP A1 - Beckers, Kristian A1 - Faßbender, Stephan A1 - Heisel, Maritta A1 - Schmidt, Holger T1 - Using Security Requirements Engineering Approaches to Support ISO 27001 Information Security Management Systems Development and Documentation T2 - 2012 Seventh International Conference on Availability, Reliability and Security N2 - An ISO 27001 compliant information security management system is difficult to create, due to the the limited support for system development and documentation provided in the standard. We present a structured analysis of the documentation and development requirements in the ISO 27001 standard. Moreover, we investigate to what extent existing security requirements engineering approaches fulfill these requirements. We developed relations between these approaches and the ISO 27001 standard using a conceptual framework originally developed for comparing security requirements engineering methods. The relations include comparisons of important terms, techniques, and documentation artifacts. In addition, we show practical applications of our results. Y1 - 2012 UR - https://ieeexplore.ieee.org/document/6329189 SN - 978-1-4673-2244-7 U6 - https://doi.org/10.1109/ARES.2012.35 SP - 242 EP - 248 PB - IEEE CY - Prague ER - TY - CHAP A1 - Beckers, Kristian A1 - Faßbender, Stephan A1 - Heisel, Maritta A1 - Küster, Jan-Christoph A1 - Schmidt, Holger ED - Barthe, Gilles ED - Livshits, Benjamin ED - Scandariato, Riccardo T1 - Supporting the Development and Documentation of ISO 27001 Information Security Management Systems through Security Requirements Engineering Approaches T2 - Engineering Secure Software and Systems: 4th International Symposium, ESSoS 2012, Eindhoven, The Netherlands, February, 16-17, 2012. Proceedings KW - Security standards KW - requirements engineering KW - ISO27000 KW - ISO27001 KW - security Y1 - 2012 UR - https://link.springer.com/chapter/10.1007/978-3-642-28166-2_2 SN - 978-3-642-28165-5 U6 - https://doi.org/10.1007/978-3-642-28166-2_2 VL - LNCS, 7159 SP - 14 EP - 21 PB - Springer CY - Berlin, Heidelberg ER - TY - CHAP A1 - Schwittek, Widura A1 - Schmidt, Holger A1 - Beckers, Kristian A1 - Eicker, Stefan A1 - Faßbender, Stephan A1 - Heisel, Maritta T1 - A Common Body of Knowledge for Engineering Secure Software and Services T2 - 2012 Seventh International Conference on Availability, Reliability and Security N2 - The discipline of engineering secure software and services brings together researchers and practitioners from software, services, and security engineering. This interdisciplinary community is fairly new, it is still not well integrated and is therefore confronted with differing perspectives, processes, methods, tools, vocabularies, and standards. We present a Common Body of Knowledge (CBK) to overcome the aforementioned problems. We capture use cases from research and practice to derive requirements for the CBK. Our CBK collects, integrates, and structures knowledge from the different disciplines based on an ontology that allows one to semantically enrich content to be able to query the CBK. The CBK heavily relies on user participation, making use of the Semantic MediaWiki as a platform to support collaborative writing. The ontology is complemented by a conceptual framework, consisting of concepts to structure the knowledge and to provide access to it, and a means to build a common terminology. We also present organizational factors covering dissemination and quality assurance. KW - software engineering KW - security engineering KW - services computing KW - common body of knowledge KW - interdisciplinary Y1 - 2012 UR - https://ieeexplore.ieee.org/document/6329223 SN - 978-1-4673-2244-7 U6 - https://doi.org/10.1109/ARES.2012.31 N1 - Sie haben Zugriff auf den Volltext innerhalb des HSD Campus. VL - NESSoS, ICT-2009.1.4 Trustworthy ICT, Grant No. 25698 SP - 499 EP - 506 PB - IEEE CY - Prague ER - TY - CHAP A1 - Schmidt, Holger A1 - Hatebur, Denis A1 - Heisel, Maritta ED - Mouratidis, Haralambos T1 - A Pattern-Based Method to Develop Secure Software T2 - Software Engineering for Secure Systems: Industrial and Research Perspectives N2 - The authors present a security engineering process based on security problem frames and concretized security problem frames. Both kinds of frames constitute patterns for analyzing security problems and associated solution approaches. They are arranged in a pattern system that makes dependencies between them explicit. The authors describe step-by-step how the pattern system can be used to analyze a given security problem and how solution approaches can be found. Afterwards, the security problems and the solution approaches are formally modeled in detail. The formal models serve to prove that the solution approaches are correct solutions to the security problems. Furthermore, the formal models of the solution approaches constitute a formal specification of the software to be developed. Then, the specification is implemented by generic security components and generic security architectures, which constitute architectural patterns. Finally, the generic security components and the generic security architecture that composes them are refined and the result is a secure software product built from existing and/or tailor-made security components. KW - security KW - problems Y1 - 2011 SN - 978-1-61520-837-1 U6 - https://doi.org/10.4018/978-1-61520-837-1.ch003 SP - 32 EP - 74 PB - IGI Global CY - Hershey ER - TY - CHAP A1 - Hatebur, Denis A1 - Heisel, Maritta A1 - Jürjens, Jan A1 - Schmidt, Holger ED - Giannakopoulou, Dimitra ED - Orejas, Fernando T1 - Systematic Development of UMLsec Design Models Based on Security Requirements T2 - Fundamental Approaches to Software Engineering: 14th International Conference, FASE 2011, Held as Part of the Joint European Conferences on Theory and Practice of Software, ETAPS 2011, Saarbrücken, Germany, March 26–April 3, 2011. Proceedings KW - security requirement KW - secquence diagram KW - eclipse modeling framework KW - patient monitoring system KW - security requirement engineering Y1 - 2011 UR - https://link.springer.com/chapter/10.1007/978-3-642-19811-3_17 SN - 978-3-642-19810-6 U6 - https://doi.org/10.1007/978-3-642-19811-3_17 VL - LNCS, 6603 SP - 232 EP - 246 PB - Springer CY - Berlin, Heidelberg ER - TY - CHAP A1 - Côté, Isabelle A1 - Heisel, Maritta A1 - Schmidt, Holger A1 - Hatebur, Denis T1 - UML4PF — A tool for problem-oriented requirements analysis T2 - 2011 IEEE 19th International Requirements Engineering Conference N2 - We present UML4PF, a tool for requirements analysis based on problem frames. It consists of a UML profile and an Eclipse-Plugin to model and analyze problem diagrams, derive specifications, and develop architectures. KW - Unified modeling language KW - problem frames KW - tool support KW - programming KW - generators Y1 - 2011 UR - https://ieeexplore.ieee.org/document/6051670 SN - 978-1-4577-0924-1 U6 - https://doi.org/10.1109/RE.2011.6051670 N1 - Sie haben Zugriff auf den Volltext innerhalb des HSD Campus. SP - 349 EP - 350 PB - IEEE CY - Trento ER - TY - CHAP A1 - Schwittek, Widura A1 - Schmidt, Holger A1 - Eicker, Stefan A1 - Heisel, Maritta ED - Filipe, Joaquim ED - Liu, Kecheng T1 - Towards a Common Body of Knowledge for Engineering Secure Software and Services T2 - Proceedings of the International Conference on Knowledge Management and Information Sharing N2 - Interdisciplinary communities involve people and knowledge from different disciplines in addressing a common challenge. Differing perspectives, processes, methods, tools, vocabularies, and standards are problems that arise in this context. We present an approach to support bringing together disciplines based on a common body of knowledge (CBK), in which knowledge from different disciplines is collected, integrated, and structured. The novelty of our approach is twofold: first, it introduces a CBK ontology, which allows one to semantically enrich contents in order to be able to query the CBK in a more elaborate way afterwards. Second, it heavily relies on user participation in building up a CBK, making use of the Semantic MediaWiki as a platform to support collaborative writing. The CBK ontology is backed by a conceptual framework, consisting of concepts to structure the knowledge, to provide access options to it, and to build up a common terminology. To ensure a high quality of the provided contents and to sustain the community’s commitment, we further present organizational means as part of our approach. We demonstrate our work using the example of a Network of Excellence EU project, which aims at bringing together researchers and practitioners from services computing, security and software engineering. KW - common body of knowledge KW - knowledge management KW - software engineering KW - security engineering KW - services computing Y1 - 2011 SP - 369 EP - 374 PB - SciTePress - Science and Technology Publications CY - Paris ER - TY - JOUR A1 - Fabian, Benjamin A1 - Gürses, Seda A1 - Heisel, Maritta A1 - Santen, Thomas A1 - Schmidt, Holger T1 - A comparison of security requirements engineering methods JF - Requirements Engineering N2 - This paper presents a conceptual framework for security engineering, with a strong focus on security requirements elicitation and analysis. This conceptual framework establishes a clear-cut vocabulary and makes explicit the interrelations between the different concepts and notions used in security engineering. Further, we apply our conceptual framework to compare and evaluate current security requirements engineering approaches, such as the Common Criteria, Secure Tropos, SREP, MSRA, as well as methods based on UML and problem frames. We review these methods and assess them according to different criteria, such as the general approach and scope of the method, its validation, and quality assurance capabilities. Finally, we discuss how these methods are related to the conceptual framework and to one another. KW - security requirement KW - security requirement engineering KW - comparison KW - security Y1 - 2010 UR - https://link.springer.com/article/10.1007/s00766-009-0092-x U6 - https://doi.org/10.1007/s00766-009-0092-x SN - 0947-3602 N1 - Sie haben Zugriff auf den Volltext innerhalb des HSD Campus. VL - 15 IS - 1 SP - 7 EP - 40 PB - Springer CY - Wiesbaden ER -