On the comprehension of security risk scenarios

Proceedings - IEEE Workshop on Program Comprehension

Volumn , Issue , 2005, Pages 115-124

  Hogganvik, Ida ^a   Stølen, Ketil ^a  

^a SINTEF ICT   (Norway)

Author keywords

[No Author keywords available]

Indexed keywords

BRAINSTORMING; CORAS MODELLING LANGUAGE; SECURITY RISK ANALYSIS; UNIFIED MODELLING LANGUAGE;

COMPUTER GRAPHICS; COMPUTER PROGRAMMING LANGUAGES; EXPERT SYSTEMS; RISK ASSESSMENT;

SECURITY OF DATA;

EID: 27744601070     PISSN: 10928138     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (23)

1. Australian/New Zealand Standard for Risk Management (AS/NZS 4360): Strathfield Standards Australia, 1999.
2. British Standard BS4778: Quality vocabulary: Availability, reliability and maintainability terms. Glossary of international terms: British Standards Institute, 1991.
3. CORAS, http://coras.sourceforge.net
4. IEC 61508: Functional Safety of Electrical/Electronic/Programmable Electronic Safety-Related (E/E/PE) Systems, 1998-2000.
5. IEEE-1471: "Recommended Practice for Architectural Description of Software-intensive Systems" (IEEE1471-2000 Std): IEEE, 2000.
6. IEEE Std 610.12: IEEE Standard Glossary of Software Engineering Terminology, 1990.
7. ISO/IEC 13335: Information technology - Guidelines for management of IT Security, 1996-2000.
8. ITU-T X.800: Security architecture for open system interconnection for CCITT applications. (Technically aligned with ISO 7498-2). Geneva, 1991.
9. Object Management Group (OMG), http://www.omg.org
10. J. Ø. Aagedal, F. den Braber, T. Dimitrakos, B. A. Gran, D. Raptis, and K. Stølen, "Model-based risk assessment to improve enterprise security," Proc. Enterprise Distributed Object Communication (EDOC'2002), pp. 51-62, 2002.
11. C. Atkinson, T. Kühne, and B. Henderson-Sellers, "Stereotypical Encounters of the Third Kind," Proc. 5th International Conference on The Unified Modeling Language, pp. 100-114, Dresden, 2002.
12. F. den Braber, T. Dimitrakos, B. A. Gran, M. Soldal Lund, K. Stølen, and J. Ø. Aagedal, UML and the unified Process: IRM Press, 2003.
13. F. den Braber, M. S. Lund, and K. Stølen, "Using the CORAS Threat Modelling Language to Document Threat Scenarios for several Microsoft relevant Technologies," SINTEF ICT, Technical Report (STF90 A04057), 2004.
14. F. den Braber, M. S. Lund, K. Stølen, and F. Vraalsen, "Integrating Security in the Development Process with UML," in Encyclopedia of Information Science and Technology, M. Khosrow-Pour, Ed.: Idea Group Reference, 2005, pp. 1560-1566.
15. F. den Braber, A.-B. Mildal, J. Nes, K. Stølen, and F. Vraalsen, Experiences from Using the CORAS Methodology to Analyze a Web Application, in To appear in Journal of Cases on Information Technology, 2005.
16. T. Dimitrakos, B. Ritchie, D. Raptis, J. Ø. Aagedal, F. den Braber, K. Stølen, and S. H. Houmb, "Integrating model-based security risk management into eBusiness systems development - the CORAS approach.," Proc. 2nd IFIP Conference on E-Commerce, E-Business, E-Government (13E'2003), pp.159-175, 2002.
17. I. Hogganvik and K. Stølen, "Empirical Investigations of the CORAS Language for Structured Brainstorming," SINTEF ICT (STF90 A05041), 2005.
18. J. Krogstie and S. d. F. Arnesen, "Assessing Enterprise Modeling Languages Using a Generic Quality Framework," in Information Modeling Methods and Methodologies: Idea Group, 2005, pp. 63-79.
19. L. Kuzniarz, M. Staron, and C. Wohlin, "An Empirical Study on Using Stereotypes to Improve Understanding of UML Models," Proc. 12th IEEE International Workshop on Program Comprehension (IWPC'04), pp.14-23, 2004.
20. M. S. Lund, I. Hogganvik, F. Seehusen, and K. Stølen, "UML profile for security assessment," SINTEF ICT, Technical report (STF40 A03066), 2003.
21. F. Redmill, M. Chudleigh, and J. Catmur, Hazop and software Hazop: Wiley, 1999.
22. J. Rumbaugh, I. Jacobson, and G. Booch, The Unified Modeling Language Reference Manual: Addison Wesley Longman, Inc., 1998.
23. R. E. Walpole, R. H. Myers, and S. L. Myers, Probability and Statistics for Engineers and Scientists, 6 ed: Prentice Hall International, Inc., 1998.