Managing Security Control Assumptions Using Causal Traceability
المؤلف | Nhlabatsi, Armstrong |
المؤلف | Yu, Yijun |
المؤلف | Zisman, |
المؤلف | rea |
المؤلف | Tun, Thein |
المؤلف | Khan, Niamul |
المؤلف | Bandara, Arosha |
المؤلف | Khan, Khaled M. |
المؤلف | Nuseibeh, Bashar |
تاريخ الإتاحة | 2024-04-02T06:04:49Z |
تاريخ النشر | 2015 |
اسم المنشور | Proceedings - 2015 IEEE/ACM 8th International Symposium on Software and Systems Traceability, SST 2015 |
المصدر | Scopus |
الملخص | Security control specifications of software systems are designed to meet their security requirements. It is difficult to know both the value of assets and the malicious intention of attackers at design time, hence assumptions about the operational environment often reveal unexpected flaws. To diagnose the causes of violations in security requirements it is necessary to check these design-time assumptions. Otherwise, the system could be vulnerable to potential attacks. Addressing such vulnerabilities requires an explicit understanding of how the security control specifications were defined from the original security requirements. However, assumptions are rarely explicitly documented and monitored during system operation. This paper proposes a systematic approach to monitoring design-time assumptions explicitly as logs, by using trace ability links from requirements to specifications. The work also helps identify which alternative specifications of security control can be used to satisfy a security requirement that has been violated based on the logs. The work is illustrated by an example of an electronic patient record system. |
اللغة | en |
الناشر | Institute of Electrical and Electronics Engineers Inc. |
الموضوع | Assumptions Causal Traceability Security |
النوع | Conference Paper |
الصفحات | 43-49 |
الملفات في هذه التسجيلة
الملفات | الحجم | الصيغة | العرض |
---|---|---|---|
لا توجد ملفات لها صلة بهذه التسجيلة. |
هذه التسجيلة تظهر في المجموعات التالية
-
علوم وهندسة الحاسب [2288 items ]