Name
Abstract | ||
|---|---|---|
Tracing and integrating security requirements throughout the development process is a key challenge in security engineering. In socio-technical systems, security requirements for the organizational and technical aspects of a system are currently dealt with separately, giving rise to substantial misconceptions and errors. In this paper, we present a model-based security engineering framework for supporting the system design on the organizational and technical level. The key idea is to allow the involved experts to specify security requirements in the languages they are familiar with: business analysts use BPMN for procedural system descriptions; system developers use UML to design and implement the system architecture. Security requirements are captured via the language extensions SecBPMN2 and UMLsec. We provide a model transformation to bridge the conceptual gap between SecBPMN2 and UMLsec. Using UMLsec policies, various security properties of the resulting architecture can be verified. In a case study featuring an air traffic management system, we show how our framework can be practically applied. |
Year | DOI | Venue |
|---|---|---|
2017 | 10.1109/MODELS.2017.10 | 2017 ACM/IEEE 20th International Conference on Model Driven Engineering Languages and Systems (MODELS) |
Keywords | Field | DocType |
socio-technical systems,security,model transformation,BPMN,UML | Security testing,Security through obscurity,UMLsec,Systems engineering,Software engineering,Computer science,Security engineering,Sherwood Applied Business Security Architecture,Security service,Security information and event management,Computer security model | Conference |
ISBN | Citations | PageRank |
978-1-5386-3493-6 | 4 | 0.39 |
References | Authors | |
27 | 5 | |
Name | Order | Citations | PageRank |
|---|---|---|---|
| Qusai Ramadan | 1 | 11 | 1.84 |
| Mattia Salnitri | 2 | 93 | 11.31 |
| Daniel Strüber | 3 | 116 | 21.50 |
| Jan Jurjens | 4 | 169 | 16.07 |
| Paolo Giorgini | 5 | 3761 | 250.53 |