[CSUSB]>> [CNS]>> [CSE]>> [R J Botting]>> biba.php
Bibliographic Item (1.0)
- Charles B Haley & Robert Laney & Jonathon Moffett & Bashar Nuseibeh
- Security Requirements engineering: A Framework for Representation and Analysis
- IEEE Trans Software Engineering V34n1(Jan/Feb 2008)pp133-153
- =CASESTUDY SECURITY REQUIREMENTS METHOD
- Describes a complex process and set of languages that work from security goals, to assets that are to be protected
), to requirements, thence to arguments for a particular system design satisfying the requirements, and so to the assumptions that can be rebutted, and the mitigation of the rebuttals and so forth.
- Security requirements are non-functional requirements and are closely related to the context of the machine being designed.
- Must expose assumptions about the machine and its context.
- Arguments that the system satisfies the requirements lead to lists of assumptions that can be challenged (WHY?) and rebutted.
- Rebuttals lead to mitigators that change the context and/or the requirments.
In turn the mitigators can be rebutted, and so on.
- Hence an iterative process making the design more secure.
- Uses Jackson Problem Frames
arguments, Propositional logic, and a causal logic based on
- Event1 shall cause Event2.
- Outer_argument::=Formal logic showing the design satisfies the requirement and exposing assumptions
- Inner_argument::=Explores assumptions in terms of rebuttals and mitigators.
- Process involves engineers and stakeholders in intense and fruitful discussion.
model of the mathematical process. Also methods used to achieve safety.
Search for bibliographic items containing a matching string.
Search for a specific bibliographic item by name.
To see the complete bibliography (1Mb+) select:[Bibliography]