Refine
Year of publication
Document Type
- Conference Proceeding (24)
- Part of a Book (4)
- Article (2)
- Workingpaper / Report (2)
Keywords
- security (8)
- security requirement (7)
- problem frames (4)
- security engineering (4)
- requirements engineering (3)
- security requirement engineering (3)
- software engineering (3)
- UMLsec (2)
- common body of knowledge (2)
- data security (2)
Department/institution
Forums such as Stack Overflow are used by many software developers to find a solution for a given coding problem. Found solutions, i.e. forum posts containing relevant source code, are utilized in a copy and paste manner. This behavior carries the risk that vulnerabilities contained in the source code of the forum posts are spread. Software developers should be able to identify vulnerable source code at an early stage, thereby preventing copying the corresponding source code. In this paper, we introduce the tool CopypastaVulGuard that identifies vulnerable source code in forum posts and allows software developers to omit the source code by marking the forum posts as dangerous. Our tool consists of a browser extension and a management application capable to address as examples SQL injections, remote code executions and deprecated functions based on a dump of the archive.org Stack Overflow data set. We present an evaluation of our tool's possible impact and relevance considering pros/cons and selected research questions.
Der Bereich der Informationssicherheit stellt große und insbesondere kleine und mittlere Unternehmen (KMU) vor erhebliche Herausforderungen. Zunehmende Angriffe auf IT-Systeme und Infrastrukturen haben die Informationssicherheit zum kritischen Erfolgsfaktor gemacht. Neben klassischen Zielen und Bereichen der Informationssicherheit hat vor allem die Security Awareness - das Sicherheitsbewusstsein aller Mitarbeiter eines Unternehmens - an Bedeutung gewonnen. Security Awareness bezieht sich auf jegliches Wissen und Handeln der Mitarbeiter eines Unternehmens und ist daher ein bedeutsamer Baustein zur ganzheitlichen Gewährleistung von Informationssicherheit. Die Motivation zur Entwicklung und Einführung von Informationssicherheit und insbesondere Security Awareness geht in großen Unternehmen vor allem von externen Faktoren, so z. B. der Regulierung von Branchen, aus und ist mittels globaler Standards, Normen und Frameworks implementiert. KMU sind grundsätzlich keinen geringeren Risiken als große Unternehmen ausgesetzt, verfügen jedoch nur selten über vergleichbare Schutzmaßnahmen hinsichtlich Informationssicherheit. Im Rahmen des Projekts wurden externe Anforderungen für große Unternehmen analysiert und hinsichtlich der Eignung als Grundlage für KMU bewertet. Das Projekt thematisiert weiterhin die Messbarkeit von Security Awareness sowie die in großen Unternehmen eingesetzten Maßnahmen zur Gewährleistung von Security Awareness besonders hinsichtlich ihrer Eignung für KMU.
An ISO 27001 compliant information security management system is difficult to create, due to the the limited support for system development and documentation provided in the standard. We present a structured analysis of the documentation and development requirements in the ISO 27001 standard. Moreover, we investigate to what extent existing security requirements engineering approaches fulfill these requirements. We developed relations between these approaches and the ISO 27001 standard using a conceptual framework originally developed for comparing security requirements engineering methods. The relations include comparisons of important terms, techniques, and documentation artifacts. In addition, we show practical applications of our results.
The discipline of engineering secure software and services brings together researchers and practitioners from software, services, and security engineering. This interdisciplinary community is fairly new, it is still not well integrated and is therefore confronted with differing perspectives, processes, methods, tools, vocabularies, and standards. We present a Common Body of Knowledge (CBK) to overcome the aforementioned problems. We capture use cases from research and practice to derive requirements for the CBK. Our CBK collects, integrates, and structures knowledge from the different disciplines based on an ontology that allows one to semantically enrich content to be able to query the CBK. The CBK heavily relies on user participation, making use of the Semantic MediaWiki as a platform to support collaborative writing. The ontology is complemented by a conceptual framework, consisting of concepts to structure the knowledge and to provide access to it, and a means to build a common terminology. We also present organizational factors covering dissemination and quality assurance.