Managing Security Control Assumptions Using Causal Traceability
Author | Nhlabatsi, Armstrong |
Author | Yu, Yijun |
Author | Zisman, |
Author | rea |
Author | Tun, Thein |
Author | Khan, Niamul |
Author | Bandara, Arosha |
Author | Khan, Khaled M. |
Author | Nuseibeh, Bashar |
Available date | 2024-04-02T06:04:49Z |
Publication Date | 2015 |
Publication Name | Proceedings - 2015 IEEE/ACM 8th International Symposium on Software and Systems Traceability, SST 2015 |
Resource | Scopus |
Abstract | Security control specifications of software systems are designed to meet their security requirements. It is difficult to know both the value of assets and the malicious intention of attackers at design time, hence assumptions about the operational environment often reveal unexpected flaws. To diagnose the causes of violations in security requirements it is necessary to check these design-time assumptions. Otherwise, the system could be vulnerable to potential attacks. Addressing such vulnerabilities requires an explicit understanding of how the security control specifications were defined from the original security requirements. However, assumptions are rarely explicitly documented and monitored during system operation. This paper proposes a systematic approach to monitoring design-time assumptions explicitly as logs, by using trace ability links from requirements to specifications. The work also helps identify which alternative specifications of security control can be used to satisfy a security requirement that has been violated based on the logs. The work is illustrated by an example of an electronic patient record system. |
Language | en |
Publisher | Institute of Electrical and Electronics Engineers Inc. |
Subject | Assumptions Causal Traceability Security |
Type | Conference Paper |
Pagination | 43-49 |
Files in this item
Files | Size | Format | View |
---|---|---|---|
There are no files associated with this item. |
This item appears in the following Collection(s)
-
Computer Science & Engineering [2284 items ]