2014 IEEE 1st International Workshop on Evolving Security and Privacy Requirements Engineering (ESPRE)最新文献

Pattern-based and ISO 27001 compliant risk analysis for cloud systems 基于模式和符合ISO 27001标准的云系统风险分析

2014 IEEE 1st International Workshop on Evolving Security and Privacy Requirements Engineering (ESPRE) Pub Date : 2014-09-08 DOI: 10.1109/ESPRE.2014.6890527

A. Alebrahim, Denis Hatebur, Ludger Goeke

引用次数: 6

Supporting evolving security models for an agile security evaluation 支持不断发展的安全模型，以实现敏捷的安全评估

2014 IEEE 1st International Workshop on Evolving Security and Privacy Requirements Engineering (ESPRE) Pub Date : 2014-09-08 DOI: 10.1109/ESPRE.2014.6890525

Wolfgang Raschke, Massimiliano Zilli, Philip Baumgartner, Johannes Loinig, C. Steger, Christian Kreiner

引用次数: 11

Towards a framework to measure security expertise in requirements analysis 建立一个框架来衡量需求分析中的安全专家

2014 IEEE 1st International Workshop on Evolving Security and Privacy Requirements Engineering (ESPRE) Pub Date : 2014-09-08 DOI: 10.1109/ESPRE.2014.6890522

Hanan Hibshi, T. Breaux, M. Riaz, L. Williams

{"title":"Towards a framework to measure security expertise in requirements analysis","authors":"Hanan Hibshi, T. Breaux, M. Riaz, L. Williams","doi":"10.1109/ESPRE.2014.6890522","DOIUrl":"https://doi.org/10.1109/ESPRE.2014.6890522","url":null,"abstract":"Research shows that commonly accepted security requirements are not generally applied in practice. Instead of relying on requirements checklists, security experts rely on their expertise and background knowledge to identify security vulnerabilities. To understand the gap between available checklists and practice, we conducted a series of interviews to encode the decision-making process of security experts and novices during security requirements analysis. Participants were asked to analyze two types of artifacts: source code, and network diagrams for vulnerabilities and to apply a requirements checklist to mitigate some of those vulnerabilities. We framed our study using Situation Awareness-a cognitive theory from psychology-to elicit responses that we later analyzed using coding theory and grounded analysis. We report our preliminary results of analyzing two interviews that reveal possible decision-making patterns that could characterize how analysts perceive, comprehend and project future threats which leads them to decide upon requirements and their specifications, in addition, to how experts use assumptions to overcome ambiguity in specifications. Our goal is to build a model that researchers can use to evaluate their security requirements methods against how experts transition through different situation awareness levels in their decision-making process.","PeriodicalId":274809,"journal":{"name":"2014 IEEE 1st International Workshop on Evolving Security and Privacy Requirements Engineering (ESPRE)","volume":"273 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-09-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115284845","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 7

L-SQUARE: Preliminary extension of the SQUARE methodology to address legal compliance L-SQUARE: SQUARE方法的初步扩展，以解决法律遵从问题

2014 IEEE 1st International Workshop on Evolving Security and Privacy Requirements Engineering (ESPRE) Pub Date : 2014-09-08 DOI: 10.1109/ESPRE.2014.6890524

Aaron Alva, Lisa R. Young

引用次数: 2

Argumentation-based security requirements elicitation: The next round 基于论证的安全需求引出:下一轮

2014 IEEE 1st International Workshop on Evolving Security and Privacy Requirements Engineering (ESPRE) Pub Date : 2014-08-25 DOI: 10.1109/ESPRE.2014.6890521

D. Ionita, Jan-Willem Bullee, R. Wieringa

{"title":"Argumentation-based security requirements elicitation: The next round","authors":"D. Ionita, Jan-Willem Bullee, R. Wieringa","doi":"10.1109/ESPRE.2014.6890521","DOIUrl":"https://doi.org/10.1109/ESPRE.2014.6890521","url":null,"abstract":"Information Security Risk Assessment can be viewed as part of requirements engineering because it is used to translate security goals into security requirements, where security requirements are the desired system properties that mitigate threats to security goals. To improve the defensibility of these mitigations, several researchers have attempted to base risk assessment on argumentation structures. However, none of these approaches have so far been scalable or usable in real-world risk assessments. In this paper, we present the results from our search for a scalable argumentation-based information security RA method. We start from previous work on both formal argumentation frameworks and informal argument structuring and try to find a promising middle ground. An initial prototype using spreadsheets is validated and iteratively improved via several Case Studies. Challenges such as scalability, quantify-ability, ease of use, and relation to existing work in parallel fields are discussed. Finally, we explore the scope and applicability of our approach with regard to various classes of Information Systems while also drawing more general conclusions on the role of argumentation in security.","PeriodicalId":274809,"journal":{"name":"2014 IEEE 1st International Workshop on Evolving Security and Privacy Requirements Engineering (ESPRE)","volume":"18 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-08-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"117202236","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 16

Using malware analysis to improve security requirements on future systems 使用恶意软件分析来改进未来系统的安全需求

2014 IEEE 1st International Workshop on Evolving Security and Privacy Requirements Engineering (ESPRE) Pub Date : 2014-08-01 DOI: 10.1109/ESPRE.2014.6890526

Naney R. Mead, J. Morales

引用次数: 3

Engineering privacy requirements valuable lessons from another realm 隐私工程需要从另一个领域获得宝贵的经验

2014 IEEE 1st International Workshop on Evolving Security and Privacy Requirements Engineering (ESPRE) Pub Date : 2014-08-01 DOI: 10.1109/ESPRE.2014.6890523

Y. Martín, J. D. Álamo, J. Yelmo

引用次数: 18

Semiautomatic security requirements engineering and evolution using decision documentation, heuristics, and user monitoring 使用决策文档、启发式和用户监视的半自动安全需求工程和演进

2014 IEEE 1st International Workshop on Evolving Security and Privacy Requirements Engineering (ESPRE) Pub Date : 2014-08-01 DOI: 10.1109/ESPRE.2014.6890520

Tom-Michael Hesse, Stefan Gärtner, T. Roehm, B. Paech, K. Schneider, B. Brügge

{"title":"Semiautomatic security requirements engineering and evolution using decision documentation, heuristics, and user monitoring","authors":"Tom-Michael Hesse, Stefan Gärtner, T. Roehm, B. Paech, K. Schneider, B. Brügge","doi":"10.1109/ESPRE.2014.6890520","DOIUrl":"https://doi.org/10.1109/ESPRE.2014.6890520","url":null,"abstract":"Security issues can have a significant negative impact on the business or reputation of an organization. In most cases they are not identified in requirements and are not continuously monitored during software evolution. Therefore, the inability of a system to conform to regulations or its endangerment by new vulnerabilities is not recognized. In consequence, decisions related to security might not be taken at all or become obsolete quickly. But to evaluate efficiently whether an issue is already addressed appropriately, software engineers need explicit decision documentation. Often, such documentation is not performed due to high overhead. To cope with this problem, we propose to document decisions made to address security requirements. To lower the manual effort, information from heuristic analysis and end user monitoring is incorporated. The heuristic assessment method is used to identify security issues in given requirements automatically. This helps to uncover security decisions needed to mitigate those issues. We describe how the corresponding security knowledge for each issue can be incorporated into the decision documentation semiautomatically. In addition, violations of security requirements at runtime are monitored. We show how decisions related to those security requirements can be identified through the documentation and updated manually. Overall, our approach improves the quality and completeness of security decision documentation to support the engineering and evolution of security requirements.","PeriodicalId":274809,"journal":{"name":"2014 IEEE 1st International Workshop on Evolving Security and Privacy Requirements Engineering (ESPRE)","volume":"46 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-08-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128988843","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 9