Arguing satisfaction of security requirements

Integrating Security and Software Engineering: Advances and Future Visions

Volumn , Issue , 2006, Pages 16-43

  Haley, C B ^a   Laney, R ^a   Moffett, J D ^a   Nuseibeh, B ^a  

^a OPEN UNIVERSITY   (United Kingdom)

Author keywords

[No Author keywords available]

Indexed keywords

ENGINEERING; INDUSTRIAL ENGINEERING;

FORMAL PROOFS; PROBLEM-CENTERED; SECURITY GOALS; SECURITY REQUIREMENTS;

CRYPTOGRAPHY;

EID: 84899251780     PISSN: None     EISSN: None     Source Type: Book    
DOI: 10.4018/978-1-59904-147-6.ch002     Document Type: Chapter

References (48)

1. Alexander, I. (2003). Misuse cases in systems engineering. Computing and Control Engineering Journal, 14(1), 40-45.
2. Anderson, R. (1996). A security policy model for clinical information systems. Proceedings of the 1996 IEEE Symposium on Security and Privacy (pp. 30-43). Oakland, CA.
3. Anderson, R. (2001). Security engineering: A guide to building dependable distributed systems.
4. Antón, A. I., & Earp, J. B. (2001). Strategies for developing policies and requirements for secure e-commerce systems. In A. K. Ghosh (Ed.), E-commerce security and privacy (Vol. 2, pp. 29-46). Kluwer Academic Publishers.
5. Attwood, K., Kelly, T., & McDermid, J. (2004). The use of satisfaction arguments for traceability in requirements reuse for system families: Position paper. Proceedings of the International Workshop on Requirements Reuse in System Family Engineering, 8th International Conference on Software Reuse (pp. 18-21). Carlos III University of Madrid, Spain.
6. Brewer, D. F. C., & Nash, M. J. (1989). The Chinese Wall security policy. Proceedings of the 1989 IEEE Symposium on Security and Privacy (pp. 206-214). Oakland, CA: IEEE Computer Society Press.
7. Buckingham Shum, S. J. (2003). The roots of computer supported argument visualization. In P. A. Kirschner, S. J. Buckingham Shum, & C. S. Carr (Eds.), Visualizing argumentation: Software tools for collaborative and educational sense-making (pp. 3-24). London: Springer-Verlag.
8. Burge, J. E., & Brown, D. C. (2004). An integrated approach for software design checking using design rationale. In J. S. Gero (Ed.), Proceedings of the 1st International Conference on Design Computing and Cognition (pp. 557-576). Cambridge, MA: Kluwer Academic Press.
9. Christensen, D. (2005). DC proof. Retrieved November 9, 2005, from http://www.dcproof.com/
10. Chung, L., Nixon, B., Yu, E., & Mylopoulos, J. (2000). Non-functional requirements in software engineering. Kluwer Academic Publishersx.
11. Compendium Institute. (2005). Compendium. Retrieved from http://www.compendiuminstitute.org/
12. Devanbu, P., & Stubblebine, S. (2000). Software engineering for security: A roadmap. In A. Finkelstein (Ed.), The future of software engineering. ACM Press.
13. Finkelstein, A., & Fuks, H. (1989). Multiparty specification. Proceedings of the 5th Int. Workshop on Software Specification and Design (pp. 185-195). Pittsburgh.
14. Fischer, G., Lemke, A. C., McCall, R., & Morch, A. (1996). Making argumentation serve design. In T. Moran & J. Carroll (Eds.), Design rationale concepts, techniques, and use (pp. 267-293). Lawrence Erlbaum and Associates.
15. Haley, C. B., Laney, R. C., Moffett, J. D., & Nuseibeh, B. (2004). The effect of trust assumptions on the elaboration of security requirements. Proceedings of the 12th International Requirements Engineering Conference (RE'04) (pp. 102-111). Kyoto, Japan: IEEE Computer Society Press.
16. Haley, C. B., Laney, R. C., & Nuseibeh, B. (2004). Deriving security requirements from crosscutting threat descriptions. Proceedings of the 3rd International Conference on Aspect-Oriented Software Development (AOSD'04) (pp. 112-121). Lancaster, UK: ACM Press.
17. Haley, C. B., Moffett, J. D., Laney, R., & Nuseibeh, B. (2005). Arguing security: Validating security requirements using structured argumentation. Proceedings of the 3rd Symposium on Requirements Engineering for Information Security (SREIS'05) held in conjunction with the 13th International Requirements Engineering Conference (RE'05). Paris.
18. Heitmeyer, C. L. (2001). Applying "practical" formal methods to the specification and analysis of security properties. Proceedings of the International Workshop on Information Assurance in Computer Networks: Methods, Models, and Architectures for Network Computer Security (MMM ACNS 2001) (Vol. 2052, pp. 84-89). St. Petersburg, Russia: Springer-Verlag Heidelberg.
19. Heitmeyer, C. L., Kirby, J., Lebaw, B. G., & Bharadwaj, R. (1998). SCR*: A toolset for specifying and analyzing software requirements. In A. J. Hu & M. Y. Vardi (Eds.), Proceedings of the 10th International Conference on Computer Aided Verification (Vol. 1427, pp. 526-531). Vancouver, BC, Canada: Springer.
20. Howard, M., & LeBlanc, D. (2001). Writing secure code. Microsoft Press.
21. Howitt, C. (2005). BlobLogic. Retrieved November 9, 2005, from http://users.ox.ac.uk/~univ0675/blob/blobSplash.html
22. ISO/IEC. (1999). Information technology -- security techniques - -evaluation criteria for it security -- Part 1: Introduction and general model (International Standard No. 15408-1). Geneva, Switzerland: ISO/IEC.
23. Jackson, M. (2001). Problem frames. Addison Wesley.
24. Kelly, T. P. (1999). Arguing safety: A systematic approach to safety case management. Unpublished D.Phil Dissertation, University of York.
25. Kotonya, G., & Sommerville, I. (1998). Requirements engineering: Processes and techniques. UK: John Wiley & Sons.
26. Lee, J., & Lai, K. Y. (1991). What's in design rationale? Human-Computer Interaction, Special Issue on Design Rationale, 6(3-4), 251-280.
27. Lee, Y., Lee, J., & Lee, Z. (2002). Integrating software lifecycle process standards with security engineering. Computers and Security, 21(4), 345-355.
28. Liu, L., Yu, E., & Mylopoulos, J. (2003). Security and privacy requirements analysis within a social setting. Proceedings of the 11th IEEE International Requirements Engineering Conference (RE'03). Monteray Bay, CA.
29. McDermott, J., & Fox, C. (1999). Using abuse case models for security requirements analysis. In Proceedings of the 15th Computer Security Applications Conference (ACSAC'99) (pp. 55-64). Phoenix, AZ: IEEE Computer Society Press.
30. Moffett, J. D., Haley, C. B., & Nuseibeh, B. (2004). Core security requirements artefacts (Technical Report No. 2004/23). Milton Keynes UK: Department of Computing, The Open University.
31. Moffett, J. D., Hall, J. G., Coombes, A., & McDermid, J. A. (1996). A model for a causal logic for requirements engineering. Requirements Engineering, 1(1), 27-46.
32. Mouratidis, H., Giorgini, P., & Manson, G. (2003). Integrating security and systems engineering: Toward the modelling of secure information systems. Proceedings of the 15th Conference on Advanced Information Systems Engineering (CAiSE'03). Klagenfurt/Velden, Austria: Springer-Verlag.
33. Mylopoulos, J., Borgida, A., Jarke, M., & Koubarakis, M. (1990). Telos: Representing knowledge about information systems. ACM Transactions on Information Systems (TOIS), 8(4), 325-362.
34. Newman, S. E., & Marshall, C. C. (1991). Pushing Toulmin too far: Learning from an argument representation scheme (Technical Report No. SSL-92-45). Palo Alto, CA: Xerox PARC.
35. Nuseibeh, B. (2001). Weaving together requirements and architectures. Computer (IEEE), 34(3), 115-117.
36. Potts, C., & Bruns, G. (1988). Recording the reasons for design decisions. Proceedings of the 10th International Conference on Software Engineering (ICSE'88) (pp. 418-427). Singapore: IEEE Computer Society.
37. Ramesh, B., & Dhar, V. (1992). Supporting systems development by capturing deliberations during requirements engineering. IEEE Transactions on Software Engineering, 18(6), 498-510.
38. Reed, C. (2005). Araucaria. Retrieved from http://araucaria.computing.dundee.ac.uk/
39. Rushby, J. (2001). Security requirements specifications: How and what? Proceedings of the Symposium on Requirements Engineering for Information Security (SREIS). Indianapolis.
40. Sindre, G., & Opdahl, A. L. (2000). Eliciting security requirements by misuse cases. Proceedings of the 37th International Conference on Technology of Object-Oriented Languages and Systems (TOOLS-Pacific'00) (pp. 120-131). Sydney, Australia.
41. Spafford, E. H. (1989). The internet worm program: An analysis. ACM SIGCOMM Computer Communication Review, 19(1), 17-57.
42. Tettero, O., Out, D. J., Franken, H. M., & Schot, J. (1997). Information security embedded in the design of telematics systems. Computers and Security, 16(2), 145-164.
43. Toulmin, S. E. (1958). The uses of argument. Cambridge: Cambridge University Press.
44. Toulmin, S. E., Rieke, R. D., & Janik, A. (1979). An introduction to reasoning. New York: Macmillan.
45. van Lamsweerde, A. (2001). Goal-oriented requirements engineering: A guided tour. Proceedings of the 5th IEEE International Symposium on Requirements Engineering (RE'01) (pp. 249-263). Toronto, Canada: IEEE Computer Society Press.
46. van Lamsweerde, A. (2004). Elaborating security requirements by construction of intentional anti-models. Proceedings of the 26th International Conference on Software Engineering (ICSE'04) (pp. 148-157). Edinburgh, Scotland.
47. Yu, E. (1997). Towards modelling and reasoning support for early-phase requirements engineering. Proceedings of the 3rd IEEE International Symposium on Requirements Engineering (RE'97) (pp. 226-235). Annapolis, MD.
48. Zave, P., & Jackson, M. (1997). Four dark corners of requirements engineering. Transactions on Software Engineering and Methodology (ACM), 6(1), 1-30.