Refine
Year of publication
Document Type
- Conference Proceeding (24)
- Part of a Book (4)
- Article (2)
- Workingpaper / Report (2)
Keywords
- security (8)
- security requirement (7)
- problem frames (4)
- security engineering (4)
- requirements engineering (3)
- security requirement engineering (3)
- software engineering (3)
- UMLsec (2)
- common body of knowledge (2)
- data security (2)
Department/institution
Preserving Software Quality Characteristics from Requirements Analysis to Architectural Design
(2006)
We give an enumeration of possible problem frames, based on domain characteristics, and comment on the usefulness of the obtained frames. In particular, we investigate problem domains and their characteristics in detail. This leads to fine-grained criteria for describing problem domains. As a result, we identify a new type of problem domain and come up with integrity conditions for developing useful problem frames. Taking a complete enumeration of possible problem frames (with at most three problem domains, of which only one is constrained) as a basis, we find 8 new problem frames, 7 of which we consider as useful in practical software development.
We present a security engineering process based on security problem frames and concretized security problem frames. Both kinds of frames constitute patterns for analyzing security problems and associated solution approaches. They are arranged in a pattern system that makes dependencies between them explicit. We describe step-by-step how the pattern system can be used to analyze a given security problem and how solution approaches can be found. Further, we introduce a new frame that focuses on the privacy requirement anonymity.
An ISO 27001 compliant information security management system is difficult to create, due to the the limited support for system development and documentation provided in the standard. We present a structured analysis of the documentation and development requirements in the ISO 27001 standard. Moreover, we investigate to what extent existing security requirements engineering approaches fulfill these requirements. We developed relations between these approaches and the ISO 27001 standard using a conceptual framework originally developed for comparing security requirements engineering methods. The relations include comparisons of important terms, techniques, and documentation artifacts. In addition, we show practical applications of our results.
Der Bereich der Informationssicherheit stellt große und insbesondere kleine und mittlere Unternehmen (KMU) vor erhebliche Herausforderungen. Zunehmende Angriffe auf IT-Systeme und Infrastrukturen haben die Informationssicherheit zum kritischen Erfolgsfaktor gemacht. Neben klassischen Zielen und Bereichen der Informationssicherheit hat vor allem die Security Awareness - das Sicherheitsbewusstsein aller Mitarbeiter eines Unternehmens - an Bedeutung gewonnen. Security Awareness bezieht sich auf jegliches Wissen und Handeln der Mitarbeiter eines Unternehmens und ist daher ein bedeutsamer Baustein zur ganzheitlichen Gewährleistung von Informationssicherheit. Die Motivation zur Entwicklung und Einführung von Informationssicherheit und insbesondere Security Awareness geht in großen Unternehmen vor allem von externen Faktoren, so z. B. der Regulierung von Branchen, aus und ist mittels globaler Standards, Normen und Frameworks implementiert. KMU sind grundsätzlich keinen geringeren Risiken als große Unternehmen ausgesetzt, verfügen jedoch nur selten über vergleichbare Schutzmaßnahmen hinsichtlich Informationssicherheit. Im Rahmen des Projekts wurden externe Anforderungen für große Unternehmen analysiert und hinsichtlich der Eignung als Grundlage für KMU bewertet. Das Projekt thematisiert weiterhin die Messbarkeit von Security Awareness sowie die in großen Unternehmen eingesetzten Maßnahmen zur Gewährleistung von Security Awareness besonders hinsichtlich ihrer Eignung für KMU.
The discipline of engineering secure software and services brings together researchers and practitioners from software, services, and security engineering. This interdisciplinary community is fairly new, it is still not well integrated and is therefore confronted with differing perspectives, processes, methods, tools, vocabularies, and standards. We present a Common Body of Knowledge (CBK) to overcome the aforementioned problems. We capture use cases from research and practice to derive requirements for the CBK. Our CBK collects, integrates, and structures knowledge from the different disciplines based on an ontology that allows one to semantically enrich content to be able to query the CBK. The CBK heavily relies on user participation, making use of the Semantic MediaWiki as a platform to support collaborative writing. The ontology is complemented by a conceptual framework, consisting of concepts to structure the knowledge and to provide access to it, and a means to build a common terminology. We also present organizational factors covering dissemination and quality assurance.