Security requirements engineering framework for software product lines

Information and Software Technology

Volumn 52, Issue 10, 2010, Pages 1094-1117

  Mellado, Daniel ^a   Fernández Medina, Eduardo ^b   Piattini, Mario ^b  

^a Department of Information Technologies and Systems   (Spain)

^b UNIVERSITY OF CASTILLA LA MANCHA   (Spain)

Author keywords

ISO 27001; Product lines; Requirements engineering; Security requirement; Security requirements engineering; Security software engineering

Indexed keywords

ISO 27001; PRODUCT-LINES; SECURITY REQUIREMENTS; SECURITY REQUIREMENTS ENGINEERING; SECURITY SOFTWARE;

COMPUTER SOFTWARE; REQUIREMENTS ENGINEERING; STANDARDIZATION;

MODELS;

EID: 77955431422     PISSN: 09505849     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.infsof.2010.05.007     Document Type: Article

References (62)

1. S. Abu-Nimeh, S. Miyazaki, N.R. Mead, Integrating privacy requirements into security requirements engineering, in SEKE, 2009, pp. 542-547.
2. C. Alberts, A. Dorofee, OCTAVE Method Implementation Guide v2.0, C.M.U. Software Engineering Institute, Editor, 2001, Pittsburgh (USA).
3. J.L. Arciniegas, J.C. Dueñas, J.L. Ruiz, R. Cerón, J. Bermejo, and M.A. Oltra Architecture reasoning for supporting product line evolution: an example on security T. Käkölä, J.C. Dueñas, Software Product Lines: Research Issues in Engineering and Management 2006 Springer
4. L. Aversano, G. Canfora, A.D. Lucia, and P. Gallucci Business process reengineering and workflow automation: a technology transfer experience The Journal of Systems and Software 2002 29 44
5. L. Baresi, and S. Morasca Three empirical studies on estimating the design effort of web applications ACM Transactions on Software Engineering and Methodology (TOSEM) 16 4 2007 15-1 15-40
6. Bastian Best, Jan Jürjens, B. Nuseibeh, Model-based security engineering of distributed information systems using UMLsec, in: 29th International Conference on Software Engineering (ICSE 2007), 2007, pp. 581-590.
7. J. Bayer, S. Gerard, O. Haugen, J. Mansell, B. Moller-Pedersen, J. Oldevik, P. Tessier, J.-P. Thibault, T. Widen, Consolidated product line variability modeling, in: T.Käkölä, J.C. Dueñas (Eds.), Software Product Lines: Research Issues in Engineering and Management, 2005, pp. 195-241.
8. P. Berander, A. Andrews, Requirements prioritization, in: A. Aurum, C. Wohlin (Eds.), Engineering and Managing Software Requirements, 2005, pp. 69-94.
9. A. Birk, G. Heller, Challenges for requirements engineering and management in software product line development, in: International Conference on Requirements Engineering (REFSQ 2007), 2007, pp. 300-305.
10. J. Bosh Design & Use of Software Architectures 2000 Pearson Education Limited
11. S. Bühne, G. Halmans, K. Lauenroth, K. Pohl, Scenario-based application requirements engineering, in: T. Käkölä, J.C. Dueñas (Eds.), Software Product Lines - Research Issues in Engineering and Management, 2005, pp. 161-194.
12. CERT/CC, CERT/CC Statistics 1995-2008, 2009. < http://www.cert.org/ stats/fullstats.html >.
13. P. Clements, and L. Northrop Software Product Lines: Practices and Patterns SEI Series in Software Engineering 2002 Addison-Wesley
14. L. Compagna, P.E. Khoury, A. Krausová, F. Massacci, and N. Zannone How to integrate legal requirements into a requirements engineering methodology for the development of security and privacy patterns Artificial Intelligence and Law 17 1 2009 1 30
15. K.-K.R. Choo, R.G. Smith, R. McCusker, Future directions in technology-enabled crime: 2007-09, in: Research and Public Policy Series, Australian-Government, Editor, 2007, Australian Institute of Criminology.
16. T.E. Faegri, and S. Hallsteinsen A software product line reference architecture for security T. Käkölä, J.C. Dueñas, Software Product Lines: Research Issues in Engineering and Management 2006 Springer
17. D.G. Firesmith Engineering security requirements Journal of Object Technology 2 1 2003 53 68
18. D.G. Firesmith Security use cases Journal of Object Technology 2003 53 64
19. D.G. Firesmith, Engineering safety and security related requirements for software intensive systems, in: International Conference on Software Engineering, IEEE Computer Society, 2007, p. 169.
20. P. Giorgini, H. Mouratidis, and N. Zannone Modelling security and trust with Secure Tropos H. Mouratidis, P. Giorgini, Integrating Security and Software Engineering: Advances and Future Visions 2007 Idea Group Publishing 160 189
21. P. Grünbacher, N. Seyff, Requirements negotiation, in: A. Aurum, C. Wohlin (Eds.), Engineering and Managing Software Requirements, 2005, pp. 143-162.
22. C.B. Haley, R. Laney, J.D. Moffet, and B. Nuseibeh Security requirements engineering: a framework for representation and analysis IEEE Transactions on Software Engineering 34 1 2008 133 153
23. ISO/IEC, ISO/IEC 13335 Information Technology - Security Techniques - Management of Information and Communications Technology Security, 2004.
24. ISO/IEC, ISO/IEC 15446 Information Technology - Security Techniques - Guide for the Production of Protection Profiles and Security Targets, 2004.
25. ISO/IEC, ISO/IEC 15408:2005 Information Technology - Security Techniques - Evaluation Criteria for IT Security (Common Criteria v3.0), 2005.
26. ISO/IEC, ISO/IEC 27001 Information Technology - Security Techniques - Information Security Management Systems - Requirements, 2006.
27. J. Jürjens, UMLsec: extending UML for secure systems development, in: UML 2002 - The Unified Modeling Language. Model Engineering, Languages, Concepts, and Tools. 5th International Conference, LNCS 2460, 2002, pp. 412-425.
28. J. Jürjens Secure Systems Development with UML 2005 Springer Academic Publishers
29. J. Jürjens, J. Schreck, Y. Yu, Automated analysis of permission-based security using UMLsec, in: Fundamental Approaches to Software Engineering (FASE 2008), held as part of the Joint European Conferences on Theory and Practice of Software (ETAPS 2008), 2008, pp. 292-295.
30. K. Kang, S. Cohen, J.A. Hess, W.E. Novak, and S.A. Peterson Feature-Oriented Domain Analysis (FODA) Feasibility Study 1990 Software Engineering Institute, Carnegie-Mellon University
31. H.-K. Kim., Automatic Translation Form Requirements Model into Use Cases Modeling on UML. ICCSA 2005, LNCS, 2005, pp. 769-777.
32. C. Kuloor, A. Eberlein, Aspect-oriented requirements engineering for software product lines, in: Proceedings of the 10th IEEE International Conference and Workshop on the Engineering of Computer-Based Systems (ECBS'03), 2003.
33. A.v. Lamsweerde, Elaborating security requirements by construction of intentional anti-models, in: 26th International Conference on Software Engineering (ICSE 2004), 2004, pp. 148-157.
34. J. Lasheras, R. Valencia-García, J.T. Fernández-Breis, A. Toval, An ontology-based framework for modelling security requirements, in: The 6th International Workshop on Security in Information Systems - WOSIS, 2008.
35. H.A. Linstone, and M. Turoff H.A. Linstone, M. Turoff, The Delphi Method: Techniques and Applications 1975 Addison-Wesley Publishing Company
36. L. Liu, E.S.K. Yu, J. Mylopoulos, Security and privacy requirements analysis within social setting, in: 11th IEEE International Requirements Engineering Conference (RE'03), 2003.
37. MAP, Methodology for Information Systems Risk Analysis and Management, in: Ministry for Public Administration, 2005.
38. F. Massacci, M. Prest, and N. Zannone Using a security requirements engineering methodology in practice: the compliance with the Italian data protection legislation Computers Standards and Interfaces 2005 445 455
39. N.R. Mead, E.D. Hough, Security requirements engineering for software systems: case studies in support of software engineering education, in: CSEE&T, 2006, pp. 149-158.
40. N.R. Mead, E. Hough, T. Stehney, Security Quality Requirements Engineering (SQUARE) Methodology, (CMU/SEI-2005-TR-009), Software Engineering Institute, Carnegie Mellon University, Pittsburgh (USA), 2005.
41. D. Mellado, E. Fernández-Medina, M. Piattini, A comparative study of proposals for establishing security requirements for the development of secure information systems, in: The 2006 International Conference on Computational Science and its Applications (ICCSA 2006), vol. 3, Springer LNCS 3982, 2006, pp. 1044-1053.
42. D. Mellado, E. Fernández-Medina, and M. Piattini A common criteria based security requirements engineering process for the development of secure information systems Computer Standards and Interfaces 29 2 2007 244 253
43. D. Mellado, E. Fernández-Medina, M. Piattini, Security requirements variability for software product lines, in: Symposium on Requirements Engineering for Information Security (SREIS 2008) co-located with ARES 2008, 2008, pp. 1413-1420.
44. D. Mellado, C. Blanco, L.E. Sanchez, and E. Fernández-Medina A systematic review of security requirements engineering Computers Standards & Interfaces 32 2010 153 165
45. D. Mellado, E. Fernández-Medina, and M. Piattini Towards security requirements management for software product lines: a security domain requirements engineering process Computer Standards & Interfaces 30 2008 361 371
46. D. Mellado, E. Fernández-Medina, M. Piattini, A systematic review of security requirements engineering, Computers Standards & Interfaces, 2010. < http://dx.doi.org/10.1016/j.csi.2010.01.006 > (accessed 02.02.10).
47. D. Mellado, J. Rodríguez, E. Fernández-Medina, M. Piattini, Automated support for security requirements engineering in software product line domain engineering, in: The Fourth International Conference on Availability, Reliability and Security (ARES 2009), 2009.
48. E. Niemelä, and A. Immonen Capturing quality requirements of product family architecture Information & Software Technology 2007 1107 1120
49. OECD, The promotion of a culture of security for information systems and networks in OECD countries, in: DSTI/ICCP/REG(2005)1/FINAL, Organisation for Economic Co-operation and Development, 2005.
50. OMG, Reusable Assets Specification (RAS), 2004 (ptc/04-06-06).
51. OMG, Software & Systems Process Engineering Meta-Model Specification v.2.0, 2008. < http://www.omg.org/spec/SPEM >.
52. A.L. Opdahl, and G. Sindre Experimental comparison of attack trees and misuse cases for security threat identification Information and Software Technology 51 5 2010 916 932
53. K. Pohl, G. Böckle, and F.v.d. Linden Software Product Line Engineering Foundations, Principles and Techniques 2005 Berlin Heidelberg Berlin
54. K. Schmid, and I. John A customizable approach to full-life cycle variability management Science of Computer Programming vol. 53 2004 Elsevier 259 284
55. K. Schmid, K. Krennrich, M. Eisenbarth, Requirements Management for Product Lines: A Prototype, Fraunhofer IESE, 2005.
56. B. Schneier Attack trees Dr. Dobb's Journal 24 12 1999
57. SEI, +SAFE, V1.2 A Safety Extension to CMMI-DEV V1.2. 2007, Pittsburgh (USA): Software Engineering Institute, Carnegie Mellon University.
58. G. Sindre, D.G. Firesmith, A.L. Opdahl. A reuse-based approach to determining security requirements, in: Proc. 9th International Workshop on Requirements Engineering: Foundation for Software Quality (REFSQ'03), Austria, 2003.
59. G. Sindre, and A.L. Opdahl Eliciting security requirements with misuse cases Requirements Engineering 10 1 2005 34 44
60. M. Sinnema, S. Deelstra, J. Nijhuis, J. Bosch, COVAMOF: a framework for modeling variability in software product families, in: Proc. of the Third Softw. Product Line Conf. (SPLC 2004), Boston, MA, USA, 2004.
61. A. Toval, J. Nicolás, B. Moros, and F. García Requirements reuse for improving information systems security: a practitioner's approach Requirements Engineering 2002 205 219
62. E. Yu, L. Liu, and Mylopoulos A Social Ontology for Integrating Security and Software Engineering Integrating Security and Software Engineering: Advances and Future Visions 2007 Idea Group Publishing