Refine
Year of publication
Document Type
- Article (387)
- Conference Proceeding (318)
- Part of a Book (72)
- Workingpaper / Report (34)
- Master's Thesis (8)
- Book (5)
- Doctoral Thesis (5)
- Collection (4)
- Preprint (4)
- Patent (3)
Language
- English (851) (remove)
Keywords
- VSVR (39)
- DOAJ (37)
- Virtual (TV) Studio (23)
- FHD (22)
- Forena (12)
- Poster (8)
- security (8)
- security requirement (7)
- DEAL (6)
- Lehre (6)
Department/institution
- Fachbereich - Medien (343)
- Fachbereich - Maschinenbau und Verfahrenstechnik (295)
- Creative Media Production and Entertainment Computing (142)
- Fachbereich - Sozial- & Kulturwissenschaften (90)
- Fachbereich - Elektro- & Informationstechnik (67)
- Sound and Vibration Engineering (42)
- Digitale Vernetzung und Informationssicherheit (30)
- Fachbereich - Architektur (22)
- Fachbereich - Wirtschaftswissenschaften (18)
- Intelligente Mensch-Technik-Interaktion (12)
The ISO 27000 is a well-established series of information security standards. The scope for applying these standards can be an organisation as a whole, single business processes or even an IT application or IT infrastructure. The context establishment and the asset identification are among the first steps to be performed. The quality of the results produced when performing these steps has a crucial influence on the subsequent steps such as identifying loss, vulnerabilities, possible attacks and defining countermeasures. Thus, a context analysis to gather all necessary information in the initial steps is important, but is not offered in the standard. In this paper, we focus on the scope of cloud computing systems and present a way to support the context establishment and the asset identification described in ISO 27005. A cloud system analysis pattern and different kinds of stakeholder templates serve to understand and describe a given cloud development problem, i.e. the envisaged IT systems and the relevant parts of the operational environment. We illustrate our support using an online banking cloud scenario.
The Security Twin Peaks
(2011)
In this paper, we present an approach to adopt UMLsec, which is defined for UML 1.5, to support the current UML version 2.3. The new profile UMLsec4UML2 is technically constructed as a UML profile diagram, which is equipped with a number of integrity conditions expressed using OCL. Consequently, the UMLsec4UML2-profile can be loaded in any Eclipse-based EMF- and MDT-compatible UML editing tool to develop and analyze different kinds of security models. The OCL constraints replace the static checks of the tool support for the old UMLsec defined for UML 1.5. Thus, the UMLsec4UML2-profile not only provides the whole expresiveness of UML2.3 for security modeling, it also brings considerably more freedom in selecting a basic UML editing tool, and it integrates modeling and analyzing security models. Since UML2.3 comprises new diagram types, as well as new model elements and new semantics of diagram types already contained in UML1.5, we consider a number of these changes in detail. More specifically, we consider composite structure and sequence diagrams with respect to modeling security properties according to the original version of UMLsec. The goal is to use UMLsec4UML2 to specify architectural security patterns.
In this paper, the author aim to present a threat and risk-driven methodology to security requirements engineering. The chosen approach has a strong focus on gathering, modeling, and analyzing the environment in which a secure ICT-system to be built is located. The knowledge about the environment comprises threat and risk models. As presented in the paper, this security-relevant knowledge is used to assess the adequacy of security mechanisms, which are then selected to establish security requirements.
Developing security-critical systems is difficult, and there are many well-known examples of vulnerabilities exploited in practice. In fact, there has recently been a lot of work on methods, techniques, and tools to improve this situation already at the system specification and design. However, security-critical systems are increasingly long-living and undergo evolution throughout their lifetime. Therefore, a secure software development approach that supports maintaining the needed levels of security even through later software evolution is highly desirable. In this chapter, we recall the UMLsec approach to model-based security and discuss on tools and techniques to model and verify evolution of UMLsec models.
The authors present a security engineering process based on security problem frames and concretized security problem frames. Both kinds of frames constitute patterns for analyzing security problems and associated solution approaches. They are arranged in a pattern system that makes dependencies between them explicit. The authors describe step-by-step how the pattern system can be used to analyze a given security problem and how solution approaches can be found. Afterwards, the security problems and the solution approaches are formally modeled in detail. The formal models serve to prove that the solution approaches are correct solutions to the security problems. Furthermore, the formal models of the solution approaches constitute a formal specification of the software to be developed. Then, the specification is implemented by generic security components and generic security architectures, which constitute architectural patterns. Finally, the generic security components and the generic security architecture that composes them are refined and the result is a secure software product built from existing and/or tailor-made security components.
Considering legal aspects during software development is a challenging problem, due to the cross-disciplinary expertise required. The problem is even more complex for cloud computing systems, because of the international distribution, huge amounts of processed data, and a large number of stakeholders that own or process the data. Approaches exist to deal with parts of the problem, but they are isolated from each other. We present an integrated method for elicitation of legal requirements. A cloud computing online banking scenario illustrates the application of our methods. The running example deals with the problem of storing personal information in the cloud and based upon the BDSG (German Federal Data Protection Act). We describe the structure of the online banking cloud system using an existing pattern-based approach. The elicited information is further refined and processed into functional requirements for software development. Moreover, our method covers the analysis of security-relevant concepts such as assets and attackers particularly with regard to laws. The requirements artifacts then serve as inputs for existing patterns for the identification of laws relevant for the online banking cloud system. Finally, our method helps to systematically derive functional as well as security requirements that realize the previously identified laws.
The discipline of engineering secure software and services brings together researchers and practitioners from software, services, and security engineering. This interdisciplinary community is fairly new, it is still not well integrated and is therefore confronted with differing perspectives, processes, methods, tools, vocabularies, and standards. We present a Common Body of Knowledge (CBK) to overcome the aforementioned problems. We capture use cases from research and practice to derive requirements for the CBK. Our CBK collects, integrates, and structures knowledge from the different disciplines based on an ontology that allows one to semantically enrich content to be able to query the CBK. The CBK heavily relies on user participation, making use of the Semantic MediaWiki as a platform to support collaborative writing. The ontology is complemented by a conceptual framework, consisting of concepts to structure the knowledge and to provide access to it, and a means to build a common terminology. We also present organizational factors covering dissemination and quality assurance.
An ISO 27001 compliant information security management system is difficult to create, due to the the limited support for system development and documentation provided in the standard. We present a structured analysis of the documentation and development requirements in the ISO 27001 standard. Moreover, we investigate to what extent existing security requirements engineering approaches fulfill these requirements. We developed relations between these approaches and the ISO 27001 standard using a conceptual framework originally developed for comparing security requirements engineering methods. The relations include comparisons of important terms, techniques, and documentation artifacts. In addition, we show practical applications of our results.
The “Journal of Virtual Reality and Broadcasting” is an open access E-journal covering advanced media technology for the integration of human computer interaction and modern information systems. The main focus is on the creation of synergies between such basic technologies as computer graphics and state-of-the-art broadcasting techniques.
The main goals are to publish research results in the field of Virtual Reality and Broadcasting, to provoke discussions, and to promote the exchange of ideas and information. Developments in the area have a direct effect on society, therefore social aspects will also be considered. As an interdisciplinary field Virtual Reality requires multilateral collaboration in order to enable new applications.
RB publishes articles consecutively and in electronic form only. All articles are peer-reviewed in a strict review process by at least three independent experts from the appropriate field of research and appear in the English language. The articles are organized in one volume per year with ten to twenty articles. Material that has been previously presented at conferences undergo a major revision and are extended and modified by the authors with at least 20% new material according to the Journal's policy for previously published articles. The Journal has been established in 2004.
Currently, the submission and publication of articles is free of charge. No author fees are applied.
Marktdaten
(2018)
Die in der Schriftenreihe Trading verwendeten Forschungsdaten beinhalten historische Kursdaten, geliefert von Lenz+Partner AG (Deutschland), für eine Auswahl an Aktien. Die Datei „FEBRDUSA_1“ zeigt diese Auswahl in Form der deutschen Wertpapierkennnummer (Spalte „Titel“), des Handelszeitraums (Spalten „Beginn“ und „Ende“) und des Aktiennamens. Kursdaten sind in dieser Datei nicht enthalten, sondern liegen in einer umfangreichen Datenbank vor.
Die Marktdaten umfassen 867 Aktien und sind das Ergebnis eines im Jahr 2015 durchgeführten Auswahlprozesses mit dem Ziel, Datenqualität und Handelbarkeit der Aktien zu verbessern. Es wurden folgende Bedingungen gefordert:
- Die Aktien werden an der Frankfurter Börse gehandelt.
- Sie sind in einem der deutschen Aktienindizes DAX, MDAX, TECDAX, SDAX, HDAX, CDAX, Technology All Share, Prime All Share und GEX oder in den amerikanischen Aktienindizes S&P 500 oder Nasdaq 100 gelistet.
- Die Kursdaten der in Frankfurt gehandelten Aktien enden nicht vor dem Jahr 2014.
- Der (unbereinigte) Eröffnungskurs Ende 2013 beträgt mindestens 1 EUR. Diese Bedingung soll dazu beitragen, das Handeln von „penny stocks“ zu verhindern.
Die vorliegende Marktdefinition resultierte in 867 Aktien, die frühestens am 11. Dezember 2014 enden, sodass eine Auswertung der Marktdaten mit vollständigen Kurswerten bis zu diesem Zeitpunkt möglich ist. Der Markt ist groß genug, um interessante Kaufbedingungen mit einer ausreichend großen Anzahl an Kaufkandidaten zu untersuchen.
The OECD Base Erosion Profit Shifting (BEPS) Initiative as well as the current fairness oriented public discussion regarding the taxation of digital business models highlight the importance and complexity of the arm's length principle. In a theoretical model of an internationally fragmented digital good's production process, we show that fairness considerations of tax authorities (namely inequity aversion) can result in a falling apart between a perceived "fair" and arm's length distribution of profits across tax jurisdictions. Our model predicts that a multinational firm follows the fundamental paradigm of international taxation, i.e. the arm's length principle, to properly incentivize internal agents involved in the production of a digital good. However, with inequity averse tax authorities, we find that tax authorities "prefer" a more equal distribution of profits compared to the arm's length allocation. From a multinational firm's perspective, inequity aversion among tax authorities dampens the strategic effect to - in accordance with arm's length principle - shift profits to low tax countries.
Progressive web applications (PWAs) seem to be the next big thing in the mobile landscape. These are web applications with “super-powers” which are meant to provide the kinds of user experiences previously only native mobile applications could. Therefore they are able to match native applications in their capabilities but still thrive on the reachability of the web. They achieve this by implementing certain characteristics which originate from innovative standards and sophisticated best practices. Conveniently, as it is the web, PWAs are working seamlessly cross-platform. One of the closest things to a PWA so far may be an application created with the NativeScript framework. Such an application is also developed with web technologies yet able to use any native interface directly. This is made possible by using a designated runtime for mediating between JavaScript and the mobile system. Eventually, NativeScript is able to offer a high degree nativity yet also of convenient abstraction during development. This paper is set out to deliver further insight into both approaches by contrasting them based on the characteristics of PWAs. For this purpose, these characteristics are elaborated and adjusted to be applicable to native mobile applications. Hence a reasonable basis for what to expect from a native application is derived. Then NativeScript is assessed on this basis by the means of transferable concepts and technologies as well as a prototypic mobile application. Finally, an informed discussion and conclusion is performed based on the results. The comprehensive characteristics of PWAs resolve previous shortcomings with well thought out concepts and new technologies. These are transferable to native mobile applications to a far extent and may also be put into practice with NativeScript. The framework’s approach may be very well called ingenious, however, in the long run it might fall short of the innovative concept of PWAs. Having said this, it is still able to serve as a practical measure for creating appealing user experiences for multiple systems with arguably little effort. Due to large overlap a transformation between the two application types is a realistic option. Either way, web technologies are far from what they used to be and it is exciting to see how the mobile and web landscape will evolve in the future.