Model-driven security engineering of service oriented systems

Lecture Notes in Business Information Processing

Volumn 5, Issue , 2008, Pages 59-71

  Breu, Ruth ^a   Hafner, Michael ^a   Innerhofer Oberperfler, Frank ^a   Wozak, Florian ^b  

^a UNIVERSITY OF INNSBRUCK   (Austria)

^b UNIVERSITY FOR HEALTH SCIENCES   (Austria)

Author keywords

Security analysis; Security engineering; Service oriented architecture

Indexed keywords

INFORMATION SERVICES; INFORMATION SYSTEMS; INFORMATION USE; SECURITY SYSTEMS;

FUNCTIONAL ASPECTS; INTER-ORGANIZATIONAL; MODEL DRIVEN SECURITY; SECURITY ANALYSIS; SECURITY ENGINEERING; SECURITY REQUIREMENTS; SECURITY SERVICES; SERVICE ORIENTED SYSTEMS;

SERVICE ORIENTED ARCHITECTURE (SOA);

EID: 84994715673     PISSN: 18651348     EISSN: 18651356     Source Type: Book Series    
DOI: 10.1007/978-3-540-78942-0_8     Document Type: Conference Paper

References (21)

1. SHVT Manual, Fraunhofer Institute for Secure Telecooperation (2004)
2. Business Process Modeling Notation (BPMN) Information (2006), Available online: http://www.bpmn.org
3. IHE.net: IT Infrastructure Technical Framework (2006), Available online: http://www.ihe.net
4. Alberts, C.J., Dorofee, A.J.: Managing information security risks: the OCTAVE approach. Pearson Education, London (2002)
5. Basin, D., Doser, J., Lodderstedt, T.: Model driven security for process-oriented systems. In: Proc. 8th ACM Symposium on Access Control Models and Technologies, ACM Press, New York (2003)
6. Breu, R., Popp, G., Alam, M.: Model-based development of access policies. Journal for Software Tools and Technology Transfer (STTT) 9, 457-470 (2007)
7. Datta, A., Derek, A., Mitchell, J.C., Pavlovic, D.: A derivation system and compositional logic for security protocols. Journal of Computer Security 13, 423-482 (2005)
8. Giorgini, P., et al.: ST-Tool: A CASE Tool for Modeling and Analyzing Trust Requirements. In: Herrmann, P., Issarny, V., Shiu, S.C.K. (eds.) iTrust 2005. LNCS, vol. 3477, Springer, Heidelberg (2005)
9. Federal Office for Information Security (BSI). IT Baseline Protection Manual (2003), Available online: http://www.bsi.bund.de/english/gshb/manual/index.htm
10. Gutierrez, C., Fernandez-Medina, E., Piattini, M.: Security risk analysis in web services systems. In: Proc. SECRYPT 2006, pp. 425-430 (2006)
11. Hafner, M., Agreiter, B., Breu, R., Nowak, A.: SECTET - An Extensible Framework for the Realization of Secure Inter-Organizational Workflows. Journal of Internet Research (2006)
12. Hailey, C., Laney, R., Moffett, J., Nuseibeh, B.: Security requirements engineering, a framework for representation and analysis. IEEE Transactions on Software Engineering (to appear, 2007)
13. Jürjens, J.: Secure Systems Development with UML. Springer, Heidelberg (2004)
14. Lodderstedt, T., Basin, D., Doser, J.: SecureUML: A UML-Based Modeling Language for Model-Driven Security. In: Jézéquel, J.-M., Hussmann, H., Cook, S. (eds.) UML 2002. LNCS, vol. 2460, pp. 426-441. Springer, Heidelberg (2002)
15. Peltier, T.R.: Risk analysis and risk management. Information Systems Security 13(4), 44-56 (2004)
16. Innerhofer-Oberperfler, F., Breu, R., Yautsiukhin, A.: Quantitative assessment of enterprise security systems (submitted)
17. Raptis, D., Dimitrakos, T., Gran, B.A., Stølen, K.: The CORAS Approach for Model-based Risk Management applied to e-Commerce Domain. In: Proc. CMS-2002, pp. 169-181 (2002)
18. Rodriguez, A., Fernandez-Medina, E., Piattini, M.: Capturing Security Requirements in Business Processes Through a UML 2.0 Activity Diagrams Profile. In: Roddick, J.F., Benjamins, V.R., Si-said Cherfi, S., Chiang, R., Claramunt, C., El-masri, R.A., Grandi, F., Han, H.. Hepp, M., Lytras, M., Mišić, V.B., Poels, G., Song, I.-Y., Trujillo, J., Vangenot, C. (eds.) ER Workshops 2006. LNCS, vol. 4231, pp. 32-42. Springer, Heidelberg (2006)
19. Schabetsberger, T., Ammenwerth, Breu, R., Hoerbst, A., Goebel, G., Penz, R., Schindelwig, K., Toth, H., Vogl, R., Wozak, F.: E-Health Approach to Link-up Actors in the Health Care System of Austria. Stud. Health Technol. Inform. 124
20. Service Central de la Securite des Systemes d’Information. Expression of needs and identification of safety objectives (EBIOS) (online, 1997)
21. Wozak, F., Ammenwerth, E., Breu, M., Penz, R., Schabetsberger, T., Vogl, R., Wurz, M.: Medical Data GRIDs as approach towards secure cross enterprise document sharing (based on IHE XDS). In: Proc. MIE 2006, pp. 377-383 (2006)