AMBRA - Automated model-based risk analysis

Proceedings of the ACM Conference on Computer and Communications Security

Volumn , Issue , 2007, Pages 43-48

  Aime, Marco D ^a   Atzeni, Andrea ^a   Pomi, Paolo C ^a  

^a POLITECNICO DI TORINO   (Italy)

Author keywords

Languages; Management; Security

Indexed keywords

RISK ASSESSMENT;

AUTOMATED MODELLING; LANGUAGE; MODEL-BASED RISK ANALYSIS; PROCEDURAL SECURITY; SECURITY; SECURITY EXPERTS; SECURITY MEASURE; TECHNICAL SECURITY;

RISK ANALYSIS;

EID: 57849101921     PISSN: 15437221     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1314257.1314272     Document Type: Conference Paper

References (27)

1. Y. Asnar, P. Giorgini, and J. Mylopoulos. Risk modelling and reasoning in goal models. Technical Report DIT-06-008, Informatica e Telecomunicazioni, University of Trento, March 2006.
2. G. Braedeland and K. Stolen. Using model-based security analysis in component-oriented system development. In Proc. of the 2nd ACM workshop on Quality of protection (QoP'06), pages 11-18, 30 October 2006.
3. CCTA. CCTA risk analysis and management method (CRAMM). http://www.cramm.com.
4. The CORAS project. http://coras.sourceforge.net/.
5. FIRST. Common Vulnerability Scoring System (CVSS). http://www.first.org/ cvss/cvss-guide.html.
6. E. Gamma, R. Helm, R. Johnson, and J. Vlissides. Design patterns: elements of reusable object-oriented software. Addison-Wesley Professional, 1995.
7. Gamma Secure Systems. A practitioner's view of CRAMM. http://www.gammassl.co.uk/topics/hot5.html.
8. J. Hallberg, A. Hunstad, and M. Peterson. A framework for system security assessment. In Proc. of the 6th IEEE Systems, Man and Cybernetics (SMC) Information Assurance Workshop (IAW), pages 224-231, 15-17 June 2005. (Pubitemid 43948726)
9. J. D. Howard. An Analysis Of Security Incidents On The Internet 1989 - 1995. http://www.cert.org/research/JHThesis/, 7 April 1997.
10. ISO/IEC 17799. Information technology - Security techniques - Code of practice for information security management. 2005.
11. ISO/IEC Guide 73:2002. Risk management - Vocabulary - Guidelines for use in standards. 2002.
12. E. Jonsson. An integrated framework for security and dependability. In Proc. of the 1998 workshop on New security paradigms (NSPW'98), pages 22-29, 22-25 September 1998.
13. N. Kavantzas, D. Burdett, G. Ritzinger, T. Fletcher, Y. Lafon, and C. Barreto. Web services choreography description language version 1.0. W3C Recommendation, http://www.w3.org/TR/ws-cdl-10/, November 2005.
14. J. Kephart and D. Chess. The vision of autonomic computing. Computer, 36:41-50, January 2003.
15. H. Langweg and E. Snekkenes. A classification of malicious software attacks. In Proc. of 23rd IEEE Int. Conference on Performance, Computing, and Communications, pages 827-832, 15-17 April 2004.
16. B. Martin, C. Sullo, and J. Kouns. OSVDB: Open Source Vulnerability Database. http://www.osvdb.org/database-info.php.
17. N. Mayer, A. Rifaut, and E. Dubois. Towards a risk-based security requirements engineering framework. In Proc. of 11th Int. Workshop on Requirements Engineering: Foundation for Software Quality (REFSQ'05), Porto, Portugal, pages 83-98, 13-14 June 2005.
18. Microsoft Corporation. Understanding the SDM to SML evolution. http://www.microsoft.com/business/dsi/sdmwp.mspx, 16 February 2007.
19. Ministerio de Administraciones Publicas. Methodology for information systems risk analysis and management (MAGERIT) version 2. http://www.csae.map. es/.
20. MITRE. Common vulnerabilities and exposures web site. http://www.cve.mitre.org/.
21. S. Naqvi and M. Riguidel. Quantifiable security metrics for large scale heterogeneous systems. In Proc. of 40th IEEE Int. Carnahan Conference on Security Technology, pages 209-215, 16-19 October 2006.
22. NIST. National vulnerability database. http://nvd.nist.gov/.
23. POSITIF Project. System Description Language (PSDL) and Security Policy Language (PSPL). http://www.positif.org/.
24. B. Schneier. The Psychology of Security. http://www.schneier.com/essay- 155.html, 28 February 2007.
25. SERENITY Project. Report on state of the art workflow security technology. http://www.serenity-forum.org/.
26. G. Stoneburner, A. Goguen, and A. Feringa. Risk management guide for information technology systems. http://csrc.nist.gov/publications/nistpubs/800- 30/sp800-30.pdf, July 2002.
27. The DMTF Technical Committee. The Common Information Model. http://www.dmtf.org/standards/cim.