A Systematic Framework for Structured Object-Oriented Security Requirements Analysis in Embedded Systems

The primary goal of this paper is to develop a structured objectoriented security requirements analysis methodology for the elicitation and analysis of security requirements in embedded systems. There are several approaches to elicit, analyze and specify security requirements in embedded systems ranging from formal mathematical models for proof of certain security properties to informal methods that are easily understood. Applicability of formal security models is limited because they are complex and it is time consuming to develop. On the other hand, informal security requirements analysis methods are not integrated with conceptual models in requirements analysis, and although both external and internal threats have been dealt using use cases and misuse cases, they provide no process for analyzing both internal and external threats in a structured manner. This paper discusses a structured object-oriented security requirements analysis methodology for the elicitation and analysis of security requirements in embedded systems. It is capable of identifying hierarchically both external and internal threats posed by both external and internal actors of a system level by level. It is illustrated and validated by security requirements analysis for an advanced embedded power grid control system

Deriving security requirements from crosscutting threat descriptions

It is generally accepted that early determination of the stakeholder requirements assists in the development of systems that better meet the needs of those stakeholders. General security requirements frustrate this goal because it is difficult to determine how they affect the functional requirements of the system. This paper illustrates how representing threats as crosscutting concerns aids in determining the effect of security requirements on the functional requirements. Assets (objects that have value in a system) are first enumerated, and then threats on these assets are listed. The points where assets and functional requirements join are examined to expose vulnerabilities to the threats. Security requirements, represented as constraints, are added to the functional requirements to reduce the scope of the vulnerabilities. These requirements are used during the analysis and specification process, thereby incorporating security concerns into the functional requirements of the system

Analysis of Security Vulnerabilities in Web Applications using Threat Modeling

Software security issues have been a major concern to the cyberspace community; therefore, a great deal of research on security testing has been performed, and various security testing techniques have been developed. A security process that is integrated into the application development cycle is required for creating a secure system. A part of this process is to create a threat profile for an application. The present project explains this process as a case study for analyzing a web application using Threat Modeling. This analysis can be used in the security testing approach that derives test cases from design level artifacts

A Systematic Framework for Structured Object-Oriented Security Requirements Analysis

ABSTRACT The primary goal of this paper is to develop a structured objectoriented security requirements analysis methodology for the elicitation and analysis of security requirements in embedded systems. There are several approaches to elicit, analyze and specify security requirements in embedded systems ranging from formal mathematical models for proof of certain security properties to informal methods that are easily understood. Applicability of formal security models is limited because they are complex and it is time consuming to develop. On the other hand, informal security requirements analysis methods are not integrated with conceptual models in requirements analysis, and although both external and internal threats have been dealt using use cases and misuse cases, they provide no process for analyzing both internal and external threats in a structured manner. This paper discusses a structured object-oriented security requirements analysis methodology for the elicitation and analysis of security requirements in embedded systems. It is capable of identifying hierarchically both external and internal threats posed by both external and internal actors of a system level by level. It is illustrated and validated by security requirements analysis for an advanced embedded power grid control system

Modeling security and privacy requirements: A use case-driven approach

Context: Modern internet-based services, ranging from food-delivery to home-caring, leverage the availability of multiple programmable devices to provide handy services tailored to end-user needs. These services are delivered through an ecosystem of device-specific software components and interfaces (e.g., mobile and wearable device applications). Since they often handle private information (e.g., location and health status), their security and privacy requirements are of crucial importance. Defining and analyzing those requirements is a significant challenge due to the multiple types of software components and devices integrated into software ecosystems. Each software component presents peculiarities that often depend on the context and the devices the component interact with, and that must be considered when dealing with security and privacy requirements. Objective: In this paper, we propose, apply, and assess a modeling method that supports the specification of security and privacy requirements in a structured and analyzable form. Our motivation is that, in many contexts, use cases are common practice for the elicitation of functional requirements and should also be adapted for describing security requirements. Method: We integrate an existing approach for modeling security and privacy requirements in terms of security threats, their mitigations, and their relations to use cases in a misuse case diagram. We introduce new security-related templates, i.e., a mitigation template and a misuse case template for specifying mitigation schemes and misuse case specifications in a structured and analyzable manner. Natural language processing can then be used to automatically report inconsistencies among artifacts and between the templates and specifications. Results: We successfully applied our approach to an industrial healthcare project and report lessons learned and results from structured interviews with engineers. Conclusion: Since our approach supports the precise specification and analysis of security threats, threat scenarios and their mitigations, it also supports decision making and the analysis of compliance to standards

Alignment of Misuse Cases to ISSRM

Digitaalse ja sotsiaalse elu vaheline piirjoon on hägunemas ning informatsiooni süsteemide turvalisuse ja informatsiooni per se turvalisus tekitab muret. Samuti pälvib tähelepanu süsteemide turvalisuse arendamine ja säilitamine. Olemasolevad uurimused viitavad mitmetele juhtumitele, kus turvalisuse aspekti võeti arvesse ainult süsteemi väljatöötamise protsessi lõpus, jättes välja süstemaatilise turvalisuse analüüsi süsteemi ja tarkvara nõuete ja kavandamise etappidel. Misuse case diagrams on üks võimalikke viise seostada turvalisuse analüüsi ja süsteemi funktusionaalsete nõuete definitsiooni. Nende peamine eesmärk on negatiivsete stsenaariumite modeleerimine, seoses defineeritud süsteemi funktsionaalsete nõuete esilekutsumise ja analüüsiga. Hoolimata sellest eelisest on väärkasutatud juhtumid üsna ebatäpsed; nad ei täida riskianalüüsi organiseerimise strateegiaid, ja seega võivad viia valetõlgendamiseni turvalisusega seotud konseptsioonides. Sellised limitatsioonid võivad potentsiaalselt viia puudulike lahendusteni turvalisuse alal. Sageli tuleb organisatsioonidel leida enda turvalisuse lahendused, et kaitsta oma ressursse ja varasid. Käesolevas töös rakendame süstemaatilist lähenemist, et mõista kuidas Misuse case diagrams aitavad organiseerida ettevõtete varasid, potentsiaalseid süsteemiriske ja turvalisuse nõudeid, et leevendada riske. Täpsemalt ühtlustame Misuse case konstruktsiooni domeeni mudeli kontseptiga, informatsiooni süsteemi turvalisusriski haldamiseks (Information Systems Security Risk Management; ISSRM). Lisaks, põhinedes ISSRM ja keelelisele ühtlustamisele, uurime ja arendame reeglid, et tõlkida Misuse cas diagrams Secure Tropos mudelile. Käesoleva uurimuse panusel on mitmeid eeliseid. Esmalt aitab potentsiaalselt mõista, kuidas Misuse case turvalisuse riski haldamisega tegeleb. Teiseks määratleb meetodi, mis toetab turvalisuse nõuete põhjendamist arendatud süsteemi kehtestamisel ja rakendamisel. Viimaseks, Secure Troposi transformeerumine aitab potentsiaalselt arendajatel (ja teistel süsteemi vahendajatel) mõista miks turvalisuse lahendused on olulised ning millised on erinevate huvigruppide kompromissid. Plaanime kinnitada saadud tulemused, kus mudeli kvaliteet seoses selle arusaadavusega on mõõdetud Misuse case diagram jaoks. Usume, et selline Misuse case seadistamine koos ISSRM ja Misuse case diagram transformeerumine eesmärgile orienteeritud modelleerumisele, on kasulik süsteemi ja tarkvara arendajatele. Esmalt aitab mõista turvalisusega seotud probleeme varajastes arendamise staadiumites. Teiseks aitab vaadata probleemi erinevatest vaatenurkadest, mõistes erinevaid turvalisuse arendamise perspektiive.As a line between digital and social life is diminishing, security concerns of information systems and information per se, also developing and maintaining system security are gaining a rising attention. Nevertheless, the existing practices report on numerous cases when security aspects were considered only at the end of the system development process, thus, missing the systematic security analysis during system and software requirements and design stages. Misuse case diagrams are one of the possible ways to relate security analysis and system functional requirements definition. Their main goal is to model negative scenarios with respect to the defined system functional requirement elicitation and analysis. Despite this fundamental advantage, misuse cases tend to be rather imprecise; they do not comply with security risk management strategies, and, thus, could lead to misinterpretation of the security-related concepts. Such limitations could potentially result in poor security solutions. Quite often, the organizations have to adopt their own security solutions to safeguard their resources and assets. In this thesis we will apply a systematic approach to understand how misuse case diagrams could help model organisational assets, potential system risks, and security requirements to mitigate these risks. More specifically we will align misuse case constructs with the concepts of the domain model for the information systems security risk management (ISSRM). In addition, based on such an ISSRM and language alignment we will investigate and develop rules to translate misuse case diagrams to the Secure Tropos model. The contribution of this research has several benefits. Firstly, it will potentially help understand how misuse case could deal with security risk management. Secondly, it will define method to support reasoning for the security requirements introduction and implementation in the developed system. Finally the transformation to the Secure Tropos would potentially help developers (and other system stakeholders) to understand why security solutions are important and what different stakeholder trade-offs are. We plan to validate our results where the quality model regarding its comprehensibility will be measured for the misuse case diagrams. We believe that such alignment of the misuse cases with ISSRM and misuse case diagram transformation to the goal-oriented modelling language will be beneficial to system and software developers. Firstly, it will allow understanding security concerns at the earlier stages of development. Secondly it will help to view security problems from different angles, understanding different security development perspectives

Modeling Security and Privacy Requirements for Mobile Applications: a Use Case-driven Approach

Defining and addressing security and privacy requirements in mobile apps is a significant challenge due to the high level of transparency regarding users' (private) information. In this paper, we propose, apply, and assess a modeling method that supports the specification of security and privacy requirements of mobile apps in a structured and analyzable form. Our motivation is that, in many contexts including mobile app development, use cases are common practice for the elicitation and analysis of functional requirements and should also be adapted for describing security requirements. We integrate and adapt an existing approach for modeling security and privacy requirements in terms of security threats, their mitigations, and their relations to use cases in a misuse case diagram. We introduce new security-related templates, i.e., a mitigation template and a misuse case template for specifying mitigation schemes and misuse case specifications in a structured and analyzable manner. Natural language processing can then be used to automatically detect and report inconsistencies among artifacts and between the templates and specifications. Since our approach supports stakeholders in precisely specifying and checking security threats, threat scenarios and their mitigations, it is expected to help with decision making and compliance with standards for improving security. We successfully applied our approach to industrial mobile apps and report lessons learned and results from structured interviews with engineers

Security in agile software development: A practitioner survey

Context: Software security engineering provides the means to define, implement and verify security in software products. Software security engineering is performed by following a software security development life cycle model or a security capability maturity model. However, agile software development methods and processes, dominant in the software industry, are viewed to be in conflict with these security practices and the security requirements. Objective: Empirically verify the use and impact of software security engineering activities in the context of agile software development, as practiced by software developer professionals. Method: A survey (N=61) was performed among software practitioners in Finland regarding their use of 40 common security engineering practices and their perceived security impact, in conjunction with the use of 16 agile software development items and activities. Results: The use of agile items and activities had a measurable effect on the selection of security engineering practices. Perceived impact of the security practices was lower than the rate of use would imply: This was taken to indicate a selection bias, caused by e.g. developers’ awareness of only certain security engineering practices, or by difficulties in applying the security engineering practices into an iterative software development workflow. Security practices deemed to have most impact were proactive and took place in the early phases of software development. Conclusion: Systematic use of agile practices conformed, and was observed to take place in conjunction with the use of security practices. Security activities were most common in the requirement and implementation phases. In general, the activities taking place early in the life cycle were also considered most impactful. A discrepancy between the level of use and the perceived security impact of many security activities was observed. This prompts research and methodological development for better integration of security engineering activities into software development processes, methods, and tools.</p