Refine
Year of publication
Document Type
- Conference Proceeding (24)
- Part of a Book (4)
- Article (2)
- Workingpaper / Report (2)
Keywords
- security (8)
- security requirement (7)
- problem frames (4)
- security engineering (4)
- requirements engineering (3)
- security requirement engineering (3)
- software engineering (3)
- UMLsec (2)
- common body of knowledge (2)
- data security (2)
- eclipse modeling framework (2)
- law (2)
- pattern system (2)
- services computing (2)
- software architecture (2)
- software development (2)
- Cloud computing (1)
- ISO27000 (1)
- ISO27001 (1)
- ISO27005 (1)
- IT infrastructure (1)
- KMU (1)
- OCL (1)
- Security standards (1)
- UML2 (1)
- UMLseCH (1)
- Unified modeling language (1)
- adversary model (1)
- architectual pattern (1)
- awareness (1)
- business applications (1)
- causal domain (1)
- class diagram (1)
- comparison (1)
- compliance (1)
- computer science (1)
- computer security (1)
- data encryption (1)
- data privacy (1)
- data transmission (1)
- evolution path (1)
- generators (1)
- information security (1)
- interdisciplinary (1)
- knowledge management (1)
- model element (1)
- object constraint language (1)
- patient monitoring system (1)
- patterns (1)
- problem frame (1)
- problems (1)
- programming (1)
- recommender systems (1)
- requirements (1)
- risk analysis (1)
- risk management (1)
- secquence diagram (1)
- secure design (1)
- security architecture (1)
- security engineering process (1)
- security pattern (1)
- security problem (1)
- security property (1)
- security requirements engineering (1)
- security standards (1)
- semantic web (1)
- sequence diagram (1)
- sicherheit (1)
- software evolution (1)
- software security (1)
- system security (1)
- systematic account (1)
- tool support (1)
Department/institution
Forums such as Stack Overflow are used by many software developers to find a solution for a given coding problem. Found solutions, i.e. forum posts containing relevant source code, are utilized in a copy and paste manner. This behavior carries the risk that vulnerabilities contained in the source code of the forum posts are spread. Software developers should be able to identify vulnerable source code at an early stage, thereby preventing copying the corresponding source code. In this paper, we introduce the tool CopypastaVulGuard that identifies vulnerable source code in forum posts and allows software developers to omit the source code by marking the forum posts as dangerous. Our tool consists of a browser extension and a management application capable to address as examples SQL injections, remote code executions and deprecated functions based on a dump of the archive.org Stack Overflow data set. We present an evaluation of our tool's possible impact and relevance considering pros/cons and selected research questions.
We present a security engineering process based on security problem frames and concretized security problem frames. Both kinds of frames constitute patterns for analyzing security problems and associated solution approaches. They are arranged in a pattern system that makes dependencies between them explicit. We describe step-by-step how the pattern system can be used to analyze a given security problem and how solution approaches can be found. Further, we introduce a new frame that focuses on the privacy requirement anonymity.
We give an enumeration of possible problem frames, based on domain characteristics, and comment on the usefulness of the obtained frames. In particular, we investigate problem domains and their characteristics in detail. This leads to fine-grained criteria for describing problem domains. As a result, we identify a new type of problem domain and come up with integrity conditions for developing useful problem frames. Taking a complete enumeration of possible problem frames (with at most three problem domains, of which only one is constrained) as a basis, we find 8 new problem frames, 7 of which we consider as useful in practical software development.
Preserving Software Quality Characteristics from Requirements Analysis to Architectural Design
(2006)
We present a pattern system/or security requirements engineering, consisting of security problem frames and concretized security problem frames. These are special kinds of problem frames that serve to structure, characterize, analyze, and finally solve software development problems in the area of software and system security. We equip each frame with formal preconditions and postconditions. The analysis of these conditions results in a pattern system that explicitly shows the dependencies between the different frames. Moreover, we indicate related frames, which are commonly used together with the considered frame. Hence, our approach helps security engineers to avoid omissions and to cover all security requirements that are relevant for a given problem.
Problem frames are patterns for analyzing, structuring, and characterizing software development problems. This paper presents a formal metamodel for problem frames expressed in UML class diagrams and using the formal specification notation OCL. That metamodel clarifies the nature of the different syntactical elements of problem frames, as well as the relations between them. It provides a framework for syntactical analysis and semantic validation of newly defined problem frames, and it prepares the ground for tool support for the problem frame approach.