Balancing security and performance properties during system architectural design

Software Engineering for Secure Systems: Industrial and Research Perspectives

Volumn , Issue , 2010, Pages 155-191

  Houmb, Siv Hilde ^a   Georg, Geri ^b   Petriu, Dorina C ^c   Bordbar, Behzad ^d   Ray, Indrakshi ^b   Anastasakis, Kyriakos ^d   France, Robert B ^b  

^a Telenor GBDR Platform for Service Innovation Group   (Norway)

^b Veterinary Dentistry and Oral Surgery   (United States)

^c CARLETON UNIVERSITY   (Canada)

^d UNIVERSITY OF BIRMINGHAM   (United Kingdom)

Author keywords

[No Author keywords available]

Indexed keywords

EID: 84899315800     PISSN: None     EISSN: None     Source Type: Book    
DOI: 10.4018/978-1-61520-837-1.ch006     Document Type: Chapter

References (45)

1. Alloy (2008). Alloy. Retrieved from .
2. Anastasakis, K., Bordbar, B., Georg, G., & Ray, I. (2008). On Challenges of Model Transformation from UML to Alloy. accepted for publication in Journal on Software and Systems Modeling (SOSYM) special issue of extended papers from the MODELS 2007 conference, on-line first: DOI 10.1007/s10270-008-0110-3.
3. Apostolopoulos, V., Peris, V., & Saha, D. D (1999). Transport layer security: How much does it really cost? Conference on Computer Communications (IEEE Infocom), New York, pp. 717-725.
4. Balsamo, S., DiMarco, S. A., Inverardi, P., & Simeoni, M. (2004). Model-based Performance Prediction in Software Development. IEEE Transactions on Software Engineering, 30(5), 295-310. doi:10.1109/TSE.2004.9
5. Barber, B., & Davey, J. (1992). The Use of the CCTA Risk Analysis and Management Methodology CRAMM in Health Information Systems. In K.C. Lun, P. Degoulet, T.E. Piemme, & O. Rienhoff (editors): Proceedings of MEDINFO'92, North Holland Publishing Co, Amsterdam, pp. 1589-1593.
6. Bordbar, B., & Anastasakis, K. (2005). MDA and Analysis of Web Applications. In Trends in Enterprise Application Architecture (TEAA) 2005, volume 3888 of Lecture notes in Computer Science, pages 44-55, Trondheim, Norway, 2005.3
7. CORAS. (2003). IST-2000-25031. Retrieved from http://sourceforge.net/projects/coras.
8. CVSS. (2007). Common Vulnerability Scoring System (CVSS-SIG). Retrieved from http://www.first.org/cvss/.
9. Elahi, G., & Yu, E. (2007). A goal oriented approach for modeling and analyzing security tradeoffs. In ER 2007. In Lecture Notes in Computer Science (Vol. 4801, pp. 375-390). Springer-Verlag.
10. Flechais, I., Mascolo, C., & Sasse, M. A. (2007). Integrating security and usability into the requirements and design process. International Journal of Electronic Security and Digital Forensics, 1(1), 12-26. doi:10.1504/IJESDF.2007.013589
11. France, R. B., Kim, D.-K., Ghosh, S., & Song, E. (2004). A UML-Based Pattern Specification Technique. IEEE Transactions on Software Engineering, 3(30), 193-206. doi:10.1109/TSE.2004.1271174
12. France, R. B., Ray, I., Georg, G., & Ghosh, S. (2004). (2004-1). Aspect-Oriented Approach to Design Modeling. IEE Proceedings. Software, 4(151), 173-185. doi:10.1049/ip-sen:20040920
13. Georg, G., Ray, I., Anastasakis, K., Bordbar, B., Toahchoodee, M. & Houmb, S.H. (2008). An Aspect-Oriented Methodology for Designing Secure Applications, Information and Software Technology, Special Issue on Model Based Development for Secure Information Systems, doi:10.1016/j.infsof.2008.05.004
14. Houmb, S. H. (2007). Decision Support for Choice of Security Solution: The Aspect-Oriented Risk Driven Development (AORDD) Framework. PhD thesis, Norwegian University of Science and Technology (NTNU), NTNU-Trykk, Trondheim, Norway, November 2007. ISBN 978-82-471-4588-3.
15. Houmb, S. H., Franqueira, V. N. L., & Engum, E. A. (2008). Estimating Impact and Frequency of Risks to Safety and Mission Critical Systems Using CVSS. In ISSRE 2008 Supplemental Proceedings: 1st Workshop on Dependable Software Engineering, 11 November 2008, Seattle, US. IEEE CS Conference Proceedings. IEEE Computer Society Press.
16. Houmb, S. H., & Franquira, V. N. L. (2009). Estimating ToE Risk Level using CVSS. To be published in the Proceeding of the Forth International Conference on Availability, Reliability and Security (ARES 2009), IEEE Computer Society, Fukuoka, Japan, March 16-19, 8 pages.
17. Houmb, S. H., Georg, G., Jürjens, J., & France, R. B. (2007). An Integrated Security Verification and Security Solution Trade-Off Analysis. In Mouratidis, H., & Giorgini, P. (Eds.), Integrating Security and Software Engineering: Advances and Future Vision. (pp. 190-219). Hershey, PA: Idea Group.
18. Houmb, S. H., Georg, G., France, R., Bieman, J. M. & Jürjens (2005). Cost-Benefit Trade-Off Analysis Using BBN for Aspect-Oriented RiskDriven Development. Proceedings of the Tenth IEEE International Conference on Engineering of Complex Computer Systems (ICECCS 2005), pp. 195-204.
19. IEC 61508(1998) Functional safety of electrical/electronic/programmable electronic safety-related systems.
20. ISO 15408 (2007) Common Criteria for Information Technology Security Evaluation, Version 3.1, Revision 2, CCMB-2007-09-001, CCMB-2007-09-002 and CCMB-2007-09-003.
21. ISO/IEC 27002: (2005). Information technology - Security techniques - Code of Practice for Information Security Management.
22. Jackson, D. (2006). Software Abstractions: Logic, Lanaguage, and Analysis. London, England: MIT Press.
23. Jensen, F. (1996). An introduction to Bayesian Network. University College London: UCL Press.
24. Jensen, F. V. (2001). Bayesian Networks and Decision Graphs. New York: Springer-Verlag.
25. Jürjens, J. (2005). Secure Systems Development with UML. Berlin, Heidelberg, New York: Springer-Verlag.
26. Lite Version, H. U. G. I. N. 6.8 (2007). Hugin Expert A/S, Alborg, Denmark. http://www.hugin.com.Downloaded April 19 2007.
27. Menascé, D. (2003). Security Performance. IEEE Internet Computing, 7(3), 84-87. doi:10.1109/MIC.2003.1200305
28. OMG. (2007). Unified Modeling Language: Superstructure Version 2.1.2 Formal/07/11/02. http://www.omg.org/docs/formal/07-11-02.pdf.
29. OMG. (2007-1). Unified Modeling Language: Infrastructure Specification V2.1.2. http://www.omg.org/docs/formal/07-11-04.pdf.
30. OMG MARTE. (2008). UML Profile for Modeling and Analysis of Real-Time Embedded systems (MARTE). BETA Bulletin of Experimental Treatments for AIDS, 2, http://www.omg.org/docs/ptc/08-06-08.pdf.
31. OMG SPT (2005) UML Profile for Schedulability, Performance, and Time, Version 1.1, OMG document formal/05-01-02.
32. Petriu, D. B., & Woodside, C. M. (2004). A Metamodel for Generating Performance Models from UML Designs. in Proc UML 2004, LNCS 3273, pp. 41-53, Springer.
33. Petriu, D. C., Shen, H., & Sabetta, A. (2007). Performance Analysis of Aspect-Oriented UML Models. Software and Systems Modeling, 6(4), 453-471. doi:10.1007/s10270-007-0053-0
34. Pourret, O., Nïam, P., & Marcot, B. (2008). Bayesian Networks: A Practical Guide to Applications (Statistics in Practice). John Wiley & Sons Ltd.
35. Sindre, G., & Opdahl, A. L. (2005). Eliciting security requirements with misuse cases. Requirements Engineering Journal, 10(1), 34-44. doi:10.1007/s00766-004-0194-4
36. Smith, C. U., & Williams, L. G. (2002). Performance Solutions. Reading, MA: Addison-Wesley.
37. Stølen, K., den Braber, F., Dimitrakos, T., Fredriksen, R., Gran, B., & Houmb, S. H. (2002). Model-based Risk Assessment in a ComponentBased Software Engineering Process: The CORAS Approach to Identify Security Risks. Chapter in: Business Component-Based Software Engineering (pp. 189-207). Kluwer.
38. Straw, G., Georg, G., Song, E., Ghosh, S., France, R. B., & Bieman, J. M. (2004). Model Composition Directives. Ed. A. Moreira and S. Mellor. Proceedings of the UML 2004. Springer, pp. 84-97.
39. TCP-W. (2002). Transaction Processing Performance Council benchmark TPC-W=. Retrieved from http://www.tpc.org/tpcw/
40. TLSWG. (1996). SSL 3.0 Specification. Retrieved from http://www.mozilla.org/projects/security/pki/nss/ssl/draft302.txt
41. UML2Alloy (2005). UML2Alloy website: http://www.cs.bham.ac.uk/~bxb/UML2Alloy.html
42. Whittle, J., Wijesekera, D., & Hartong, M. (2008). Executable misuse cases for modeling security concerns. In ICSE '08: Proceedings of the 30th international conference on Software engineering, pp. 121-130, ACM, New York, NY, USA, 2008.
43. Woodside, C. M., Petriu, D. C., Petriu, D. B., Shen, H., Israr, T., & Merseguer, J. (2005). Performance by Unified Model Analysis (PUMA). In Proc. 5th Int. Workshop on Software and Performance WOSP'2005, pp. 1-12, Palma, Spain, 2005.
44. Woodside, C. M., Petriu, D. C., Petriu, D. B., Xu, J., Israr, T., Georg, G., & France, R. B. (2009). a,Bieman, J. M., Houmb, S. H. & Jürjens, J. (2009). Performance Analysis of Security Aspects by Weaving Scenarios Extracted from UML Models. Journal of Systems and Software, 82, 56-74. doi:10.1016/j.jss.2008.03.067
45. Yu, E. (1997). Towards Modelling and Reasoning Support for Early-Phase Requirements Engineering. In Proc of the 3rd IEEE Int. Symposium. on Requirements Engineering (RE'97) Jan. 6-8, 1997, Washington D.C., USA. pp. 226-235.