Refine
Year of publication
- 2011 (29) (remove)
Document Type
- Conference Proceeding (15)
- Article (7)
- Part of a Book (4)
- Announcement (2)
- Workingpaper / Report (1)
Keywords
- security (4)
- VSVR (3)
- security requirement (3)
- Amtliche Mitteilungen (2)
- FHD (2)
- M (2)
- Medien (2)
- UMLsec (2)
- Virtual (TV) Studio (2)
- security engineering (2)
Department/institution
- Fachbereich - Medien (29) (remove)
The Security Twin Peaks
(2011)
In this paper, we present an approach to adopt UMLsec, which is defined for UML 1.5, to support the current UML version 2.3. The new profile UMLsec4UML2 is technically constructed as a UML profile diagram, which is equipped with a number of integrity conditions expressed using OCL. Consequently, the UMLsec4UML2-profile can be loaded in any Eclipse-based EMF- and MDT-compatible UML editing tool to develop and analyze different kinds of security models. The OCL constraints replace the static checks of the tool support for the old UMLsec defined for UML 1.5. Thus, the UMLsec4UML2-profile not only provides the whole expresiveness of UML2.3 for security modeling, it also brings considerably more freedom in selecting a basic UML editing tool, and it integrates modeling and analyzing security models. Since UML2.3 comprises new diagram types, as well as new model elements and new semantics of diagram types already contained in UML1.5, we consider a number of these changes in detail. More specifically, we consider composite structure and sequence diagrams with respect to modeling security properties according to the original version of UMLsec. The goal is to use UMLsec4UML2 to specify architectural security patterns.
In this paper, the author aim to present a threat and risk-driven methodology to security requirements engineering. The chosen approach has a strong focus on gathering, modeling, and analyzing the environment in which a secure ICT-system to be built is located. The knowledge about the environment comprises threat and risk models. As presented in the paper, this security-relevant knowledge is used to assess the adequacy of security mechanisms, which are then selected to establish security requirements.
Developing security-critical systems is difficult, and there are many well-known examples of vulnerabilities exploited in practice. In fact, there has recently been a lot of work on methods, techniques, and tools to improve this situation already at the system specification and design. However, security-critical systems are increasingly long-living and undergo evolution throughout their lifetime. Therefore, a secure software development approach that supports maintaining the needed levels of security even through later software evolution is highly desirable. In this chapter, we recall the UMLsec approach to model-based security and discuss on tools and techniques to model and verify evolution of UMLsec models.
The authors present a security engineering process based on security problem frames and concretized security problem frames. Both kinds of frames constitute patterns for analyzing security problems and associated solution approaches. They are arranged in a pattern system that makes dependencies between them explicit. The authors describe step-by-step how the pattern system can be used to analyze a given security problem and how solution approaches can be found. Afterwards, the security problems and the solution approaches are formally modeled in detail. The formal models serve to prove that the solution approaches are correct solutions to the security problems. Furthermore, the formal models of the solution approaches constitute a formal specification of the software to be developed. Then, the specification is implemented by generic security components and generic security architectures, which constitute architectural patterns. Finally, the generic security components and the generic security architecture that composes them are refined and the result is a secure software product built from existing and/or tailor-made security components.
282 - Fachbereichsordnung für den Fachbereich Medien der Fachhochschule Düsseldorf vom 28.11.2011
(2011)
Aufgrund des § 26 Abs. 3 Satz 2 des Gesetzes über die Hochschulen des Landes Nordrhein-Westfalen (Hochschulgesetz-HG) in der Fassung vom 01.01.2007, der Grundordnung der Fachhochschule Düsseldorf vom 12.07.2010 geändert durch Satzung vom 26.10.2011 hat der Fachbereichsrat des Fachbereichs Medien der Fachhochschule Düsseldorf folgende Fachbereichsordnung erlassen: