International journal of secure software engineering最新文献_第6页

Optimal Voting Strategy against Random and Targeted Attacks 针对随机和目标攻击的最优投票策略

International journal of secure software engineering Pub Date : 2013-10-01 DOI: 10.4018/ijsse.2013100102

Li Wang, Zheng Li, Shangping Ren, K. Kwiat

引用次数: 7

Semi-Automatic Annotation of Natural Language Vulnerability Reports 自然语言漏洞报告的半自动标注

International journal of secure software engineering Pub Date : 2013-07-01 DOI: 10.4018/JSSE.2013070102

Yan Wu, R. Gandhi, Harvey P. Siy

引用次数: 3

Eliciting Security Requirements for an Information System using Asset Flows and Processor Deployment 利用资产流和处理器部署引出信息系统的安全需求

International journal of secure software engineering Pub Date : 2013-07-01 DOI: 10.4018/jsse.2013070103

H. Kaiya, Junya Sakai, Shinpei Ogata, K. Kaijiri

{"title":"Eliciting Security Requirements for an Information System using Asset Flows and Processor Deployment","authors":"H. Kaiya, Junya Sakai, Shinpei Ogata, K. Kaijiri","doi":"10.4018/jsse.2013070103","DOIUrl":"https://doi.org/10.4018/jsse.2013070103","url":null,"abstract":"The authors cannot comprehensively determine all of the vulnerabilities to an attack only from requirements descriptions. To resolve the problem, the authors propose a method for eliciting security requirements using the information about system architecture. The authors convert a use-case description into a variation of a data flow diagram called an asset-flow diagram AFD. The authors then refine the AFDs based on a processor deployment diagram PDD, which gives information about a system architecture. By using vulnerabilities patterns to an attack, the authors distinguish vulnerabilities to the attack that can be identifiable in AFDs from remaining vulnerabilities to the attack. To prohibit the former vulnerabilities, security requirements are defined as countermeasures and/or modification of existing requirements. To prevent the latter vulnerabilities, security requirements are defined as design and implementation constraints. Through an evaluation of a web application, the authors show that our method enables us to elicit security requirements against several different attacks in different system architectures.","PeriodicalId":89158,"journal":{"name":"International journal of secure software engineering","volume":"46 1","pages":"42-63"},"PeriodicalIF":0.0,"publicationDate":"2013-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"82668185","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 5

Assessing the Value of Formal Control Mechanisms on Strong Password Selection 评估形式控制机制对强密码选择的价值

International journal of secure software engineering Pub Date : 2013-07-01 DOI: 10.4018/jsse.2013070101

J. Crawford

引用次数: 3

Mean Failure Cost as a Measurable Value and Evidence of Cybersecurity: E-Learning Case Study 平均故障成本作为网络安全的可测量值与证据:电子学习案例研究

International journal of secure software engineering Pub Date : 2013-07-01 DOI: 10.4018/jsse.2013070104

N. Rjaibi, Latifa Ben Arfa Rabai, Anis Ben Aissa, A. Mili

{"title":"Mean Failure Cost as a Measurable Value and Evidence of Cybersecurity: E-Learning Case Study","authors":"N. Rjaibi, Latifa Ben Arfa Rabai, Anis Ben Aissa, A. Mili","doi":"10.4018/jsse.2013070104","DOIUrl":"https://doi.org/10.4018/jsse.2013070104","url":null,"abstract":"Addressing Cybersecurity within e-Learning systems becomes empowered to make online information more secure. Certain competences need to be identified as necessary skills to manage security online such the ability to assess sources and architectural components, understanding the privacy, confidentiality and user authentication. Security management approaches quantifying security threats in e-learning are common with other e-services. It is of our need to adopt a quantitative security risk management process in order to determine the worthiest attack and the ignored one, based on financial business risk measure which is the measure of the mean failure cost.This paper proposes a cyber security measure called the Mean Failure Cost MFC suitable for e-Learning systems. It is based on the identification of system's architecture, the well-defined classes of stakeholders, the list of possible threats and vulnerabilities and the specific security requirements related to e-Learning systems and applications. In the mean time, security requirements are considered as appropriate mechanisms for preventing, detecting and recovering security attacks, for this reason an extension of the MFC measure is presented in order to detect the most critical security requirements. Also this paper highlights the security measures and guidelines for controlling e-Learning security policies regarding the most critical security requirements.","PeriodicalId":89158,"journal":{"name":"International journal of secure software engineering","volume":"PP 1","pages":"64-81"},"PeriodicalIF":0.0,"publicationDate":"2013-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"84871647","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 9

Threat Representation Methods for Composite Service Process Models 组合服务过程模型的威胁表示方法

International journal of secure software engineering Pub Date : 2013-04-01 DOI: 10.4018/jsse.2013040101

P. H. Meland, Erlend Andreas Gjære

{"title":"Threat Representation Methods for Composite Service Process Models","authors":"P. H. Meland, Erlend Andreas Gjære","doi":"10.4018/jsse.2013040101","DOIUrl":"https://doi.org/10.4018/jsse.2013040101","url":null,"abstract":"The Business Process Modeling Notation (BPMN) has become a popular standard for expressing high level business processes as well as technical specifications for software systems. However, the specification does not contain native support to express security information, which should not be overlooked in todayâ€™s world where every organization is exposed to threats and has assets to protect. Although a substantial amount of work enhancing BPMN 1.x with security related information already exists, the opportunities provided by version 2.0 have not received much attention in the security community so far. This paper gives an overview of security in BPMN and investigates several possibilities of representing threats in BPMN 2.0, in particular for design-time specification and runtime execution of composite services with dynamic behavior. Enriching BPMN with threat information enables a process-centric threat modeling approach that complements risk assessment and attack scenarios. We have included examples showing the use of error events, escalation events and text annotations for process, collaboration, choreography and conversation diagrams.","PeriodicalId":89158,"journal":{"name":"International journal of secure software engineering","volume":"199 1","pages":"1-18"},"PeriodicalIF":0.0,"publicationDate":"2013-04-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"87170789","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 6

A Taxonomy Built on Layers of Abstraction for Time and State Vulnerabilities 基于时间和状态漏洞抽象层的分类法

International journal of secure software engineering Pub Date : 2013-04-01 DOI: 10.4018/jsse.2013040103

Horia V. Corcalciuc

引用次数: 5

Mitigating Type Confusion on Java Card 减轻Java卡上的类型混淆

International journal of secure software engineering Pub Date : 2013-04-01 DOI: 10.4018/jsse.2013040102

Jean Dubreuil, Guillaume Bouffard, Bhagyalekshmy N. Thampi, Jean-Louis Lanet

{"title":"Mitigating Type Confusion on Java Card","authors":"Jean Dubreuil, Guillaume Bouffard, Bhagyalekshmy N. Thampi, Jean-Louis Lanet","doi":"10.4018/jsse.2013040102","DOIUrl":"https://doi.org/10.4018/jsse.2013040102","url":null,"abstract":"One of the challenges for smart card deployment is the security interoperability. A smart card resistant to an attack on a given platform should be able to guarantee the same behavior on another platform. But the current implementations do not comply with this requirement. In order to improve such standardization we propose a framework based on annotations with an external pre-processing to switch the Java Card Virtual Machine (JCVM) into a secure mode by activating a set of countermeasures. An example has been proposed in this paper for implementing a countermeasure against type confusion with a fault attack. Smart cards are often the target of software, hardware or combined attacks. In recent days most of the attacks are based on fault injection which can modify the behavior of applications loaded onto the card, changing them into mutant applications. This countermeasure requires a transformation of the original program byte codes which remain semantically equivalent. It needs a modification of the JCVM which stays backward compatible and a dedicated framework to deploy these applications. Thus, the proposed platform can resist to a fault enabled mutant.","PeriodicalId":89158,"journal":{"name":"International journal of secure software engineering","volume":"47 1","pages":"19-39"},"PeriodicalIF":0.0,"publicationDate":"2013-04-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"87260054","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 14

Analyzing Human Factors for an Effective Information Security Management System 分析有效信息安全管理体系的人为因素

International journal of secure software engineering Pub Date : 2013-01-01 DOI: 10.4018/JSSE.2013010104

Reza Alavi, Shareeful Islam, H. Jahankhani, Ameer Al-Nemrat

引用次数: 2

Principles and Measurement Models for Software Assurance 软件保证的原理和度量模型

International journal of secure software engineering Pub Date : 2013-01-01 DOI: 10.4018/JSSE.2013010101

N. Mead, D. Shoemaker, Carol Woody

引用次数: 3