Refine
Year of publication
Document Type
- Conference Proceeding (24)
- Article (3)
- Part of a Book (2)
- Book (1)
- Workingpaper / Report (1)
Has Fulltext
- no (31) (remove)
Keywords
- security (9)
- security requirement (6)
- problem frames (4)
- security engineering (4)
- requirements engineering (3)
- security requirement engineering (3)
- software engineering (3)
- UMLsec (2)
- common body of knowledge (2)
- data security (2)
Department/institution
- Digitale Vernetzung und Informationssicherheit (31) (remove)
Forums such as Stack Overflow are used by many software developers to find a solution for a given coding problem. Found solutions, i.e. forum posts containing relevant source code, are utilized in a copy and paste manner. This behavior carries the risk that vulnerabilities contained in the source code of the forum posts are spread. Software developers should be able to identify vulnerable source code at an early stage, thereby preventing copying the corresponding source code. In this paper, we introduce the tool CopypastaVulGuard that identifies vulnerable source code in forum posts and allows software developers to omit the source code by marking the forum posts as dangerous. Our tool consists of a browser extension and a management application capable to address as examples SQL injections, remote code executions and deprecated functions based on a dump of the archive.org Stack Overflow data set. We present an evaluation of our tool's possible impact and relevance considering pros/cons and selected research questions.
Mixed reality telepresence is becoming an increasingly popular form of interaction in social and collaborative applications. We are interested in how created virtual spaces can be archived, mapped, shared, and reused among different applications. Therefore, we propose a decentralized blockchain-based peer-to-peer model of distribution, with virtual spaces represented as blocks. We demonstrate the integration of our system in a collaborative mixed reality application and discuss the benefits and limitations of our approach.
Es scheint so zu sein, dass sich die beiden Ziele Gebrauchstauglichkeit und Sicherheit sehr häufig in der Umsetzung gegenseitig ausschließen: Eine sehr sichere Anwendung ist meistens eher aufwändiger zu benutzen und zu warten, eine einfach zu benutzende Anwendung vernachlässigt häufig die Sicherheit.
Als Lösung kann (wieder einmal) darauf hingewiesen werden, dass "gute" Software mehr ist als lediglich funktionierende Software. Im gesamten Entwicklungsprozess müssen vielfältige funktionale und nicht-funktionale Anforderungen, wie die der Sicherheit und Gebrauchstauglichkeit, berücksichtigt werden, um allen, auch sich zunächst widersprechenden, Anforderungen gerecht zu werden.
Die Interaktion zwischen Mensch und Computer ist ein sehr interessanter und immer wichtiger werdender Aspekt bei der Entwicklung von Software.
In diesem Buch erfahren Sie daher
- Wie Menschen und Computer kommunizieren, handeln und reagieren
- Welche Interaktionsformen es für die Kommunikation mit dem Computer gibt
- Wie Sie diese Kenntnisse nutzen können, um Programme zu entwickeln, die der Anwender erfolgreich nutzen kann
We present a security engineering process based on security problem frames and concretized security problem frames. Both kinds of frames constitute patterns for analyzing security problems and associated solution approaches. They are arranged in a pattern system that makes dependencies between them explicit. We describe step-by-step how the pattern system can be used to analyze a given security problem and how solution approaches can be found. Further, we introduce a new frame that focuses on the privacy requirement anonymity.
We give an enumeration of possible problem frames, based on domain characteristics, and comment on the usefulness of the obtained frames. In particular, we investigate problem domains and their characteristics in detail. This leads to fine-grained criteria for describing problem domains. As a result, we identify a new type of problem domain and come up with integrity conditions for developing useful problem frames. Taking a complete enumeration of possible problem frames (with at most three problem domains, of which only one is constrained) as a basis, we find 8 new problem frames, 7 of which we consider as useful in practical software development.
Preserving Software Quality Characteristics from Requirements Analysis to Architectural Design
(2006)
We present a pattern system/or security requirements engineering, consisting of security problem frames and concretized security problem frames. These are special kinds of problem frames that serve to structure, characterize, analyze, and finally solve software development problems in the area of software and system security. We equip each frame with formal preconditions and postconditions. The analysis of these conditions results in a pattern system that explicitly shows the dependencies between the different frames. Moreover, we indicate related frames, which are commonly used together with the considered frame. Hence, our approach helps security engineers to avoid omissions and to cover all security requirements that are relevant for a given problem.