{"title":"Combining Defense Graphs and Enterprise Architecture Models for Security Analysis","authors":"T. Sommestad, M. Ekstedt, Pontus Johnson","doi":"10.1109/EDOC.2008.37","DOIUrl":"https://doi.org/10.1109/EDOC.2008.37","url":null,"abstract":"Security is dependent on a mixture of interrelated concepts such as technical countermeasures, organizational policies, security procedures, and more. To facilitate rational decision making, these concepts need to be combined into an overall judgment on the current security posture, as well as potential future ones. Decision makers are, however, faced with uncertainty regarding both what countermeasures that is in place, and how well different countermeasures contribute to mitigating attacks. This paper presents a security assessment framework using the Bayesian statistics-based extended influence diagrams to combine attack graphs with countermeasures into defense graphs. The approach makes it possible to calculate the probability that attacks succeed based on an enterprise architecture model. The framework also takes uncertainties of the security assessment into consideration. Moreover, using the extended influence diagram formalism the expected loss from each attack can be calculated.","PeriodicalId":210496,"journal":{"name":"2008 12th International IEEE Enterprise Distributed Object Computing Conference","volume":"172 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-09-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121035553","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
K. Tserpes, D. Kyriazis, A. Menychtas, A. Litke, C. Christogiannis, T. Varvarigou
{"title":"Evaluating Quality Provisioning Levels in Service Oriented Business Environments","authors":"K. Tserpes, D. Kyriazis, A. Menychtas, A. Litke, C. Christogiannis, T. Varvarigou","doi":"10.1109/EDOC.2008.41","DOIUrl":"https://doi.org/10.1109/EDOC.2008.41","url":null,"abstract":"This paper advocates the need for a mechanism that will allow the evaluation of the provided quality of service (QoS) by a service provider to a service customer in B2B service provisioning. Furthermore, this study goes on with presenting the feasibility of this mechanism by designing and testing a reference implementation that can be used in a service oriented architecture (SOA) environment which is able to support business application services. Experience gained in the frame of the NextGRID IST project that focused on the business perspectives of Grid computing and adopted SOA as its baseline architecture, has shown that such a mechanism is essential for enabling the economic viability of such large scale computing platforms.","PeriodicalId":210496,"journal":{"name":"2008 12th International IEEE Enterprise Distributed Object Computing Conference","volume":"97 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-09-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130968677","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Customizing Choreography: Deriving Conversations from Organizational Dependencies","authors":"A. Mahfouz, L. Barroca, R. Laney, B. Nuseibeh","doi":"10.1109/EDOC.2008.34","DOIUrl":"https://doi.org/10.1109/EDOC.2008.34","url":null,"abstract":"Evolving business needs call for customizable choreographed interactions. However, choreography descriptions do not capture the problem-domain knowledge required to perform the customization effectively. Hence, we propose performing the customization to models of organizational requirements motivating the interaction. To facilitate the derivation of the resulting choreography description, we propose an alignment between conversations and organizational dependencies. We employ the domain knowledge and formal semantics of requirements models to find customization alternatives and reason about them. Using the alignment, we derive constraints on conversations systematically from customized requirements models.","PeriodicalId":210496,"journal":{"name":"2008 12th International IEEE Enterprise Distributed Object Computing Conference","volume":"126 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-09-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134581739","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Supporting Service-Oriented Design with Metrics","authors":"Helge Hofmeister, G. Wirtz","doi":"10.1109/EDOC.2008.13","DOIUrl":"https://doi.org/10.1109/EDOC.2008.13","url":null,"abstract":"The service-oriented architectural style is widely perceived today. However, service orientation is a very general concept and its application in real-life situations is somewhat ambiguous. This is partially due to the fact that service-oriented principles are subject to interpretation rather than elements of the style.In this paper we propose a set of design metrics for service-oriented design. Based on an established metric for the coupling of component-based systems we introduce a complexity metric by the means of service coupling. We argue that service aggregators and the centralization of a system's control flow is appropriate to address a system's complexity. In order to approach an objective design that incorporates these principles, we introduce four metrics for the analysis of how a system handles its complexity with service-oriented means. Finally, we apply the presented metrics to an enterprise-scale real-life case study that we have conducted.","PeriodicalId":210496,"journal":{"name":"2008 12th International IEEE Enterprise Distributed Object Computing Conference","volume":"186 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-09-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115181583","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Oliver Boehm, Jörg Caumanns, M. Franke, Oliver Pfaff
{"title":"Federated Authentication and Authorization: A Case Study","authors":"Oliver Boehm, Jörg Caumanns, M. Franke, Oliver Pfaff","doi":"10.1109/EDOC.2008.36","DOIUrl":"https://doi.org/10.1109/EDOC.2008.36","url":null,"abstract":"The loose coupling of services is a key characteristic for modern IT-systems based on SOA. This paper analyzes the design and realization of SOA security in a SOA-compliant fashion. It focuses on federated authentication and authorization based on Web services security technologies. The SOA-style infrastructure of the eCR specification is used as a practical case study. eCR systems address the exchange of medical data within regional healthcare networks. Adequate IT-security and especially federated authentication and authorization are imperative for eCR systems.","PeriodicalId":210496,"journal":{"name":"2008 12th International IEEE Enterprise Distributed Object Computing Conference","volume":"113 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-09-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124153552","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Achieving Business Process Flexibility with Business Rules","authors":"T. V. Eijndhoven, M. Iacob, María Laura Ponisio","doi":"10.1109/EDOC.2008.23","DOIUrl":"https://doi.org/10.1109/EDOC.2008.23","url":null,"abstract":"Business processes used in networked business are often large and complex, which makes them difficult to manage and change. In this paper we address this lack of flexibility by proposing a solution that uses business rules and workflow patterns to model the variable parts of process flow, thus facilitating dynamic pattern composition in these areas. We argue that the increase in flexibility is justified by the fact that changes in a business process can be confined to the variable isolated parts of the process.","PeriodicalId":210496,"journal":{"name":"2008 12th International IEEE Enterprise Distributed Object Computing Conference","volume":"27 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-09-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133738268","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Per Närman, M. Schönherr, Pontus Johnson, M. Ekstedt, M. Chenine
{"title":"Using Enterprise Architecture Models for System Quality Analysis","authors":"Per Närman, M. Schönherr, Pontus Johnson, M. Ekstedt, M. Chenine","doi":"10.1109/EDOC.2008.26","DOIUrl":"https://doi.org/10.1109/EDOC.2008.26","url":null,"abstract":"Enterprise architecture is a model-based approach to business-oriented IT management. To promote good IT decision making, an enterprise architecture framework needs to explicate what kind of analyses it supports. Since creating enterprise architecture models is expensive and without intrinsic value, it is desirable to only create enterprise architecture models based on metamodels that support well-defined analyses. This paper presents the content and extension of a metamodel which supports creating models containing the information necessary to conduct system quality analyses, specifically with respect to availability, accuracy, confidentiality and integrity. The metamodel is an extension and formalization of the metamodel underlying the ArchiMate modelling language for enterprise architecture. The use of the extended metamodel is demonstrated in a case study where the availability, accuracy, confidentiality and integrity of the two service oriented architecture (SOA) platforms Sun JCaps and PrOSeRO were evaluated.","PeriodicalId":210496,"journal":{"name":"2008 12th International IEEE Enterprise Distributed Object Computing Conference","volume":"23 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-09-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127167772","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Roger Curry, C. Kiddle, Nayden Markatchev, R. Simmonds, Tingxi Tan, M. Arlitt, Bruce J. Walker
{"title":"Facebook Meets the Virtualized Enterprise","authors":"Roger Curry, C. Kiddle, Nayden Markatchev, R. Simmonds, Tingxi Tan, M. Arlitt, Bruce J. Walker","doi":"10.1109/EDOC.2008.19","DOIUrl":"https://doi.org/10.1109/EDOC.2008.19","url":null,"abstract":"ldquoWeb 2.0rdquo and ldquocloud computingrdquo are revolutionizing the way IT infrastructure is accessed and managed. Web 2.0 technologies such as blogs, wikis and social networking platforms provide Internet users with easier mechanisms to produce Web content and to interact with each other. Cloud computing technologies are aimed at running applications as services over the Internet on a scalable infrastructure. In this paper we explore the advantages of using Web 2.0 and cloud computing technologies in an enterprise setting to provide employees with a comprehensive and transparent environment for utilizing applications. To demonstrate the effectiveness of this approach we have developed an environment that uses a social networking platform to provide access to a legacy application. The application is hosted on an internal cloud computing infrastructure that adapts dynamically to user demands. Initial feedback suggests this approach provides an improved user experience while simplifying management and increasing effective utilization of the underlying IT resources.","PeriodicalId":210496,"journal":{"name":"2008 12th International IEEE Enterprise Distributed Object Computing Conference","volume":"46 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-09-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132513679","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Modeling a Realistic Workload for Performance Testing","authors":"C. Lutteroth, Gerald Weber","doi":"10.1109/EDOC.2008.40","DOIUrl":"https://doi.org/10.1109/EDOC.2008.40","url":null,"abstract":"Load testing of Web applications can be specified by simulating realistic user behavior with stochastic form-oriented analysis models. Stochastic models have advantages over load test models that simply play back recorded session data: they are easier to specify and achieve a higher coverage of the different operational paths. There are challenges when specifying load tests such as the generation of form parameters and the recognition of pages returned by the system. We propose how these challenges can be overcome by adding additional specifications to a form-oriented model. Furthermore, we discuss several workload models and explain why some commonly used workload models are in fact unrealistic and produce misleading results. The stochastic form-oriented load testing approach can be generalized to deal with other submit-response systems such as those consisting of Web services.","PeriodicalId":210496,"journal":{"name":"2008 12th International IEEE Enterprise Distributed Object Computing Conference","volume":"56 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-09-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126527362","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Process Model Abstraction: A Slider Approach","authors":"Artem Polyvyanyy, S. Smirnov, M. Weske","doi":"10.1109/EDOC.2008.17","DOIUrl":"https://doi.org/10.1109/EDOC.2008.17","url":null,"abstract":"Process models provide companies efficient means for managing their business processes. Tasks where process models are employed are different by nature and require models of various abstraction levels. However, maintaining several models of one business process involves a lot of synchronization effort and is erroneous. Business process model abstraction assumes a detailed model of a process to be available and derives coarse grained models from it. The task of abstraction is to tell significant model elements from insignificant ones and to reduce the latter. In this paper we argue that process model abstraction can be driven by different abstraction criteria. Criterion choice depends on a task which abstraction facilitates. We propose an abstraction slider - a mechanism that allows user control of the model abstraction level. We discuss examples of combining the slider with different abstraction criteria and sets of process model transformation rules.","PeriodicalId":210496,"journal":{"name":"2008 12th International IEEE Enterprise Distributed Object Computing Conference","volume":"21 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-09-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114531010","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}