An Integrated Security Verification and Security Solution Design Trade-Off Analysis Approach

2007 ◽  
pp. 190-219 ◽  
Author(s):  
S. H. Houmb ◽  
G. Georg ◽  
J. Jurjens ◽  
R. France
Keyword(s):  
Systems Development ◽  
End Users ◽  
Security Requirements ◽  
Security Level ◽  
Critical System ◽  
Time To Market ◽  
Trade Off ◽  
Secure Systems ◽  
Alternative Design ◽  
Solution Design

This chapter describes the integrated security veri?cation and security solution design trade-off analysis (SVDT) approach. SVDT is useful when there is a diverse set of requirements imposed upon a security critical system, such as a required security level, time-to-market and budget constraints and end users’ expectations. Balancing these needs requires developers to evaluate alternative security solutions, and SVDT makes this evaluation effective. UMLsec, an extension to UML for secure systems development, is used to specify security requirements, and UMLsec tools are used to verify if the alternative design solutions satisfy security requirements.

An Integrated Security Verification and Security Solution Design Trade-Off Analysis Approach

2008 ◽  
pp. 2234-2258
Author(s):  
S. H. Houmb ◽  
G. Georg ◽  
J. Jurjens ◽  
R. France
Keyword(s):  
Systems Development ◽  
End Users ◽  
Security Requirements ◽  
Security Level ◽  
Critical System ◽  
Trade Off ◽  
Secure Systems ◽  
Alternative Design ◽  
Solution Design ◽  
Security Verification

This chapter describes the integrated security verification and security solution design trade-off analysis (SVDT) approach. SVDT is useful when there is a diverse set of requirements imposed upon a security critical system, such as a required security level, time-to-market and budget constraints and end users’ expectations. Balancing these needs requires developers to evaluate alternative security solutions, and SVDT makes this evaluation effective. UMLsec, an extension to UML for secure systems development, is used to specify security requirements, and UMLsec tools are used to verify if the alternative design solutions satisfy security requirements.

scholarly journals A novel intelligent model for classify and evaluating non-functional security requirements form scenarios

2019 ◽  
Vol 15 (3) ◽  
pp. 1578
Author(s):  
Akram AbdelKarim AbdelQader
Keyword(s):  
Security Requirements ◽  
Software Requirements ◽  
Support Vector ◽  
Svm Classifier ◽  
Security Threats ◽  
Functional Requirements ◽  
Critical System ◽  
Secure Systems ◽  
Functional Methods ◽  
Intelligent Model

Software requirements with its functional and non-functional methods are the first important phase in producing a software system with free errors. The functional requirements are the visual actions that may easily evaluated from the developer and from the user, but non-functional requirements are not visual and need a lot of efforts to be evaluated. One of the main important non-functional requirements is security, which focuses on generating secure systems from strangers. Evaluating the security of the system in earlier steps will help to reduce the efforts of reveals critical system threats. Security threats found because of leaking of security scenarios in requirement phase. In this paper, we purpose an intelligent model to extract and evaluate security features from scenarios based on set of security system goals and a set of security requirements saved on rich story scenarios dataset (RSSD). This model will used a support vector machine (SVM) classifier to classify the security requirement based on RSS dataset.  The using of SVM will enhance the overall process of evaluating the security requirements. The results show a significant enhancement in security improvements.

A Study on Cloud Storage Security Method Using Data Classification

2021 ◽  
Vol 23 (09) ◽  
pp. 1105-1121
Author(s):  
Dr. Ashish Kumar Tamrakar ◽  
◽  
Dr. Abhishek Verma ◽  
Dr. Vishnu Kumar Mishra ◽  
Dr. Megha Mishra ◽  
...  
Keyword(s):  
Cloud Storage ◽  
Storage Systems ◽  
Data Classification ◽  
Data Encryption ◽  
Security Requirements ◽  
Security And Privacy ◽  
Security Level ◽  
Distributed Resources ◽  
Storage Security ◽  
Public Data

Cloud computing is a new model for providing diverse services of software and hardware. This paradigm refers to a model for enabling on-demand network access to a shared pool of configurable computing resources, that can be rapidly provisioned and released with minimal service provider interaction .It helps the organizations and individuals deploy IT resources at a reduced total cost. However, the new approaches introduced by the clouds, related to computation outsourcing, distributed resources and multi-tenancy concept, increase the security and privacy concerns and challenges. It allows users to store their data remotely and then access to them at any time from any place .Cloud storage services are used to store data in ways that are considered cost saving and easy to use. In cloud storage, data are stored on remote servers that are not physically known by the consumer. Thus, users fear from uploading their private and confidential files to cloud storage due to security concerns. The usual solution to secure data is data encryption, which makes cloud users more satisfied when using cloud storage to store their data. Motivated by the above facts; we have proposed a solution to undertake the problem of cloud storage security. In cloud storage, there are public data that do not need any security measures, and there are sensitive data that need applying security mechanisms to keep them safe. In that context, data classification appears as the solution to this problem. The classification of data into classes, with different security requirements for each class is the best way to avoid under security and over security situation. The existing cloud storage systems use the same Journal of University of Shanghai for Science and Technology ISSN: 1007-6735 Volume 23, Issue 9, September – 2021 Page-1105 key size to encrypt all data without taking into consideration its confidentiality level. Treating the low and high confidential data with the same way and at the same security level will add unnecessary overhead and increase the processing time. In our proposal, we have combined the K-NN (K Nearest Neighbors) machine learning method and the goal programming decision-making method, to provide an efficient method for data classification. This method allows data classification according to the data owner security needs. Then, we introduce the user data to the suitable security mechanisms for each class. The use of our solution in cloud storage systems makes the data security process more flexible, besides; it increases the cloud storage system performance and decreases the needed resources, which are used to store the data.

Secure Software Development of Cyber-Physical and IoT Systems

2018 ◽  
pp. 7525-7538
Author(s):  
Muthu Ramachandran
Keyword(s):  
Business Processes ◽  
Systems Development ◽  
Cloud Services ◽  
Security Requirements ◽  
Cloud Environment ◽  
Systems Security ◽  
Development Life Cycle ◽  
General Systems ◽  
Secure Software Development

This real-world case study has been used to demonstrate the best practices on business process modelling and component based design for developing cloud services with Build Security In (BSI). BSI techniques, strategies, and processes presented in this article are general systems security principles and are applicable for both a cloud environment and traditional environment (non-cloud environment). The significant contribution of this research is to illustrate the application of the extended system security method known as SysSQUARE to elicit security requirements, identify security threats of data, as well as integrating build-in security techniques by modelling and simulating business processes upfront in the systems development life cycle.

Accommodating End-Users' Online Activities with a Campus Portal

2008 ◽  
pp. 611-622
Author(s):  
Tharitpong Fuangvut ◽  
Helen Hasan
Keyword(s):  
Information Systems ◽  
Literature Review ◽  
Systems Development ◽  
End Users ◽  
Information Systems Development ◽  
Web Based ◽  
Development Methodology ◽  
Online Activities ◽  
Campus Portal ◽  
The University

A major objective of this article is to propose a framework for development of a campus portal accommodating the end-users’ online activities, especially students who are normally considered as a major group of users for the campus portal. By summarising between the literature review in the domain of traditional information systems development methodology and Web-based information systems development methodology and the findings of the research, an appropriate model can finally be concluded and recommended, and is presented in this article. Although this article can be considered as a standalone article, it is recommended that the reader read the article entitled “The Need for a Comprehensive Methodology for Campus Portal Development.” Additionally, the complete version of this research can also be obtained from the digital thesis section of the University of Wollongong Library (http://www. library.uow.edu.au).

Access Control Specification in UML

2007 ◽  
pp. 220-243
Author(s):  
M. Koch ◽  
F. Parisi-Presicce ◽  
K. Pauls
Keyword(s):  
Access Control ◽  
Formal Semantics ◽  
Security Requirements ◽  
Software Systems ◽  
Secure Systems ◽  
Distributed Object ◽  
Access Control Policies ◽  
Software Engineers ◽  
Uml Diagrams ◽  
Distributed Object Systems

Security requirements have become an integral part of most modern software systems. In order to produce secure systems, it is necessary to provide software engineers with the appropriate systematic support. This chapter discusses a methodology to integrate the speci?cation of access control policies into UML. The methodology, along with the graph-based formal semantics for the UML access control speci?ca-tion, allows to reason about the coherence of the access control speci?cation. The chapter also presents a procedure to modify policy rules to guarantee the satisfaction of constraints, and shows how to generate access control requirements from UML diagrams. The main concepts in the UML access control speci?cation are illustrated with an example access control model for distributed object systems.

Access Control Specification in UML

2008 ◽  
pp. 1456-1475
Author(s):  
M. Koch ◽  
F. Parisi-Presicce ◽  
K. Pauls
Keyword(s):  
Access Control ◽  
Formal Semantics ◽  
Security Requirements ◽  
Software Systems ◽  
Secure Systems ◽  
Distributed Object ◽  
Access Control Policies ◽  
Software Engineers ◽  
Uml Diagrams ◽  
Distributed Object Systems

Security requirements have become an integral part of most modern software systems. In order to produce secure systems, it is necessary to provide software engineers with the appropriate systematic support. This chapter discusses a methodology to integrate the speci?cation of access control policies into UML. The methodology, along with the graph-based formal semantics for the UML access control speci?ca-tion, allows to reason about the coherence of the access control speci?cation. The chapter also presents a procedure to modify policy rules to guarantee the satisfaction of constraints, and shows how to generate access control requirements from UML diagrams. The main concepts in the UML access control speci?cation are illustrated with an example access control model for distributed object systems.

scholarly journals Combined Assessment of Software Safety and Security Requirements

2018 ◽  
Vol 20 (1) ◽  
pp. 46-69 ◽  
Author(s):  
Christian Raspotnig ◽  
Peter Karpati ◽  
Andreas L Opdahl
Keyword(s):  
Traffic Management ◽  
Modern Society ◽  
Air Traffic Management ◽  
Security Requirements ◽  
Functional Requirements ◽  
Software Safety ◽  
Secure Systems ◽  
Safety Requirements ◽  
Stakeholder Groups

Safety is a fundamental concern in modern society, and security is a precondition for safety. Ensuring safety and security of complex integrated systems requires a coordinated approach that involve different stakeholder groups going beyond safety and security experts and system developers. The authors have therefore proposed CHASSIS (Combined Harm Assessment of Safety and Security for Information Systems), a method for collaborative determination of requirements for safe and secure systems. In this article, the authors evaluate CHASSIS through industrial case studies of two small-to-medium sized suppliers to the air-traffic management (ATM) sector. The results suggest that CHASSIS is easy to use, and that handling safety and security together provides benefits because techniques, information, and knowledge can be reused. The authors conclude that further exploration and development of CHASSIS is worthwhile, but that better documentation is needed—including more detailed process guidelines—to support elicitation of security and safety requirements and to systematically relate them to functional requirements.

scholarly journals MBSEsec: Model-Based Systems Engineering Method for Creating Secure Systems

2020 ◽  
Vol 10 (7) ◽  
pp. 2574 ◽  
Author(s):  
Donatas Mažeika ◽  
Rimantas Butleris
Keyword(s):  
Systems Engineering ◽  
Impact Analysis ◽  
Early Stage ◽  
System Development ◽  
Security Analysis ◽  
Security Requirements ◽  
Security Risks ◽  
Secure Systems ◽  
Model Based ◽  
Analysis Process

This paper presents how Model-Based System Engineering (MBSE) could be leveraged in order to mitigate security risks at an early stage of system development. Primarily, MBSE was used to manage complex engineering projects in terms of system requirements, design, analysis, verification, and validation activities, leaving security aspects aside. However, previous research showed that security requirements and risks could be tackled in the MBSE model, and powerful MBSE tools such as simulation, change impact analysis, automated document generation, validation, and verification could be successfully reused in the multidisciplinary field. This article analyzes various security-related techniques and then clarifies how these techniques can be represented in the Systems Modeling Language (SysML) model and then further exploited with MBSE tools. The paper introduces the MBSEsec method, which gives guidelines for the security analysis process, the SysML/UML-based security profile, and recommendations on what security technique is needed at each security process phase. The MBSEsec method was verified by creating an application case study that reflects real-world problems and running an experiment where systems and security engineers evaluated the feasibility of our approach.

Sign in / Sign up

Export Citation Format

Share Document