The CORAS methodology: Model-based Risk Assessment Using UML and UP

UML and the Unified Process

Volumn , Issue , 2006, Pages 332-357

  den Braber, Folker ^a   Dimitrakos, Theo ^b   Gran, Bjørn Axel ^c   Lund, Mass Soldal ^a   Stølen, Ketil ^a   Aagedal, Jan Øyvind ^a  

^a SINTEF   (Norway)

^b RUTHERFORD APPLETON LABORATORY   (United Kingdom)

^c INSTITUTE FOR ENERGY TECHNOLOGY   (Norway)

Author keywords

[No Author keywords available]

Indexed keywords

EID: 85189788266     PISSN: None     EISSN: None     Source Type: Book    
DOI: None     Document Type: Chapter

References (30)

1. Australian/New Zealand Standard AS/NZS 4360(1999). Risk management.
2. Barber, B., & Davey, J. (1992). The use of the CCTA risk analysis and management methodology CRAMM. Proc. MEDINFO92, North Holland (pp. 1589-1593).
3. Bouti, A., & Ait Kadi, D. (1994). A state-of-the-art review of FMEA/FMECA. International Journal of Reliability, Quality and Safety Engineering 1 (pp. 515-543).
4. Clark, J. (November 1999). XSL transformations (XSLT) 1.0. World Wide Web Consortium recommendation REC-xslt.
5. Cockburn, A. (1997). Structuring use cases with goals. Journal of Object-oriented Programming, Sep/Oct: 35-40, Nov/Dec: 56-62.
6. Common Criteria Organization. (2002). common criteria for information technology security evaluation. On the World Wide Web: http://www.commoncriteria.org
7. Communications-Electronics Security Group. (2002). Information security evaluation criteria. On the World Wide Web:: http://www.cesg.gov.uk/assurance/iacs/itsec/index.htm
8. Control objectives for information and related technology. COBIT. On the World Wide Web: http://www.isaca.org/ct_denld.htm
9. CORAS (2000). A platform for risk analysis of security critical systems. IST-2000-25031. On the World Wide Web: http://www.nr.no/coras/
10. Curry, D., & Debar Merrill Lynch, H. (December 28, 2001). Intrusion detection message exchange format (IDMEF). Working draft.
11. Damianou, N., Dulay, N., Lupu, E., & Sloman, M. (2000). Ponder: A language for specifying security and management policies for distributed systems. The Language Specification-Version 2.2. Research Report DoC 2000/1, Department of Computing, Imperial College, London.
12. Houmb, S. H. (2002). Stochastic models and mobile E-commerce: Are stochastic models usable in the analysis of risk in mobile c-commerce? Unpublished Master's Thesis, 0stfold University College, Faculty of Computer Sciences, Halden, Norway.
13. IEC 1025. (1990). Fault tree analysis (FTA).
14. IEC 61508. (2000). Functional safety of electrical/electronic/programmable safety related systems.
15. ISO/IEC (1999). Information technology-Security techniques-Evaluation Criteria for IT Security ISO/IEC, 15408-1.
16. ISO/IEC 10746(1995). Basic reference model of open distributed processing.
17. ISO/IEC TR 13335. (2001). Information technology-Guidelines for the management of IT security.
18. ISO/IEC 17799(2000). Information technology-Code of practice for information security management.
19. Kruchten, P. (1999). The rational unified process, an introduction. Addison-Wesley.
20. Littlewood, B. (1975). A reliability model for systems with Markov structure. Appl. Stat. 24 (pp. 172-177).
21. OMG. (1999). XML Metadata Interchange (XMI).
22. OMG. (2001a). Object constraint language specification. Part of the UML specification.
23. OMG. (2001b). Unified Modeling Language specification. Version 1.4.
24. Reactive System Design Support, RSDS. On the World Wide Web: http://www.dcs.kcl.ac.uk
25. Redmill, F., Chudleigh, M., & Catmur, J. (1999). Hazop and software Hazop. Wiley.
26. Sandia National Laboratories, Surety Analysis. Accessed in 2002 from the World Wide Web: http://www.sandia.gov
27. Schneider, G., & Winters, J. P. (1998). Applying use cases: a practical guide. Addison-Wesley.
28. Sindre, G., & Opdahl, A. L. (2000). Eliciting security requirements by misuse cases. In Proc. TOOLS_PACIFIC 2000. IEEE Computer Society Press (pp. 120-131).
29. th International Conference on Information Security, Kluwer.
30. World Wide Web Consortium. (6 October, 2000). Extensible Markup Language (XML) v1.0, W3C recommendation (second edition).