Business-driven application security: From modeling to managing secure applications

IBM Systems Journal

Volumn 44, Issue 4, 2005, Pages 847-867

  Nagaratnam, Nataraj ^a   Nadalin, Anthony ^a   Hondo, Maryann ^a   McIntosh, Michael ^b   Austel, Paula ^b  

^a IBM   (United States)

^b IBM T J WATSON RESEARCH CENTER   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ADMINISTRATIVE DATA PROCESSING; DATA STRUCTURES; INFORMATION TECHNOLOGY; MATHEMATICAL MODELS; MONITORING; RESEARCH AND DEVELOPMENT MANAGEMENT; SECURITY OF DATA;

BUSINESS-DRIVEN APPLICATION; MANAGING SECURE APPLICATIONS;

INFORMATION SERVICES;

EID: 29744447253     PISSN: 00188670     EISSN: 00188670     Source Type: Journal    
DOI: 10.1147/sj.444.0847     Document Type: Article

References (28)

1. IBM Rational Software Development Platform, IBM Corporation, http://www-128.ibm.com/developerworks/platform/.
2. OMG Architecture Board MDA Drafting Team, "Model Driven Architecture: A Technical Perspective," Object Management Group, http://www.omg.org/cgi-bin/doc?ormsc/2001-07-01.
3. Model Driven Architecture, Object Management Group, http://www.omg.org/ mda.
4. G. Booch, A. W. Brown, S. Iyengar, J. Rumbaugh, and B. Selic, "An MDA Manifesto," Chapter 11, MDA Journal, D. S. Frankel and J. Parodi, editors, Meghan-Kiffer Press, Tampa, FL (2004).
5. C. Alberts and and A. Dorofee, Managing Information Security Risks: The OCTAVE (SM) Approach, Addison Wesley Professional, Boston, MA, ISBN: 0-321-11886-3 (2003).
6. FISMA Implementation Project, National Institute of Standards and Technology, http://csrc.nist.gov/sec-cert/.
7. Business Process Execution Language for Web Services, BEA Systems, IBM, Microsoft, SAP AG and Siebel Systems, http://www-128.ibm.com/ developerworks/library/specification/ws-bpel/.
8. Sarbanes-Oxley Act of 2002, http://www.sec.gov/about/laws/soa2002.pdf.
9. Business Process Modeling Notation Information, Business Process Management Initiative, http://www.bpmn.org/.
10. Business Process Definition Meta-model, http://www.omg.org/cgi-bin/ doc?bei/2003-01-03.
11. Unified Modeling Language, Object Management Group, http://www.omg.org/ uml.
12. Eclipse Modeling Frametuork, Eclipse Project, www.eclipse.org/emf.
13. M. Pistoia, N. Nagaratnam, L. Koved, and A. Nadalin, Enterprise Java Security: Building Secure J2EE Applications, Addison-Wesley Professional, Boston, MA, ISBN: 0-321-11889-8 (2004).
14. L. Koved, A. Nadalin, N. Nagaratnam, M. Pistoia, and T. Shrader, "Security Challenges for Enterprise Java in an e-business Environment," IBM Systems Journal, 40, No. 1, 130-154 (2001).
15. S. Johnston, "Modeling security concerns in service-oriented architectures," IBM developerWorks, http://www-106.ibm.com/ developerworks/rational/library/4860.htmI?ca=dnp-322.
16. J. Asensio, V. Villagra, J. Lopez, and J. Berrocal, "UML Profiles for the Specification and Instrumentation of QoS Management Information in Distributed Object-Based Applications," Proceedings of the Fifth World Multi-Conference on Systemics, Cybernetics and Informatics, ISBN: 980-07-7543-9 (July 2001), pp. 22-25.
17. T. Lodderstedt, D. Basin, and J. Doser, "SecureUML: A UML-Based Modeling Language for Model-Driven Security," Proceedings of the 5th International Conference on The Unified Modeling Language, pp. 426-441 (2002).
18. Java 2 Platform, Enterprise Edition (J2EE), Sun Micro-systems, http://java.sun.com/j2ee/.
19. M. Hondo, N. Nagaratnam, and A. Nadalin, "Securing Web Services," IBM Systems Journal, 41, No. 2, 228-241 (2002).
20. S. Johnston, "UML Profile for Software Services," IBM developerWorks, http://www-128.ibm.com/developerworks/rational/library/ 05/419_soa/.
21. P. Kruchten, "The Rational Unified Process: An Introduction (2nd Edition)," Addison-Wesley Professional, Boston, MA (2000), ISBN: 0-201-70710-1.
22. Java Authentication and Authorization Service API, Sun Microsystems, http://java.sun.com/products/jaas/.
23. Java Authorization Contract for Containers API, Sun Microsystems, http://java.sun.com/j2ee/javaacc/.
24. OASIS eXtensible Access Control Markup Language, OASIS, http://www. oasis-open.org/committees/tc_home.php?wg_abbrev=xacml.
25. Web Services Policy Frametoork, IBM, BEA, Microsoft, SAP, Sonic Software, Verisign, http://www-128.ibm.com/developerworks/library/ specification/ws-polfram/.
26. Security in a Web Services World: A Proposed Architecture and Roadmap, IBM and Microsoft, http://www-106.ibm.com/developerworks/webservices/ library/ws-secmap/.
27. Web Services Security Policy, http://www-128.ibm.com/developerworks/ library/ws-secpol/.
28. Common Base Event Specification, IBM Corporation, http://www-128.ibm.com/ developerworks/webservices/library/ws-cbe/.