Aspect Oriented Security Hardening Of Uml Design Models

This book comprehensively presents a novel approach to the systematic security hardening of software design models expressed in the standard UML language. It combines model-driven engineering and the aspect-oriented paradigm to integrate security practices into the early phases of the software development process. To this end, a UML profile has been developed for the specification of security hardening aspects on UML diagrams. In addition, a weaving framework, with the underlying theoretical foundations, has been designed for the systematic injection of security aspects into UML models. The work is organized as follows: chapter 1 presents an introduction to software security, model-driven engineering, UML and aspect-oriented technologies. Chapters 2 and 3 provide an overview of UML language and the main concepts of aspect-oriented modeling (AOM) respectively. Chapter 4 explores the area of model-driven architecture with a focus on model transformations. The main approaches that are adopted in the literature for security specification and hardening are presented in chapter 5. After these more general presentations, chapter 6 introduces the AOM profile for security aspects specification. Afterwards, chapter 7 details the design and the implementation of the security weaving framework, including several real-life case studies to illustrate its applicability. Chapter 8 elaborates an operational semantics for the matching/weaving processes in activity diagrams, while chapters 9 and 10 present a denotational semantics for aspect matching and weaving in executable models following a continuation-passing style. Finally, a summary and evaluation of the work presented are provided in chapter 11. The book will benefit researchers in academia and industry as well as students interested in learning about recent research advances in the field of software security engineering.

"Papers presented at the Eighth International Conference on New Trends in Software Methodologies, Tools and Techniques, (SoMeT 09) held in Prague, Czech Republic ... from September 23rd to 25th 2009."--P. v.

This volume pays tribute to the scientific achievements of Hartmut Ehrig, who passed away in March 2016. The contributions represent a selection from a symposium, held in October 2016 at TU Berlin, commemorating Hartmut’ s life and work as well as other invited papers in the areas he was active in. These areas include Graph Transformation, Model Transformation, Concurrency Theory, in particular Petri Nets, Algebraic Specification, and Category Theory in Computer Science.

"A refreshingly new approach toward improving use-case modeling by fortifying it with aspect orientation." --Ramnivas Laddad, author of AspectJ in Action "Since the 1980s, use cases have been a way to bring users into software design, but translating use cases into software has been an art, at best, because user goods often don''t respect code boundaries. Now that aspect-oriented programming (AOP) can express crosscutting concerns directly in code, the man who developed use cases has proposed step-by-step methods for recognizing crosscutting concerns in use cases and writing the code in separate modules. If these methods are at all fruitful in your design and development practice, they will make a big difference in software quality for developers and users alike. --Wes Isberg, AspectJ team member"This book not only provides ideas and examples of what aspect-oriented software development is but how it can be utilized in a real development project." --MichaelWard, ThoughtWorks, Inc."No system has ever been designed from scratch perfectly; every system is composed of features layered in top of features that accumulate over time. Conventional design techniques do not handle this well, and over time the integrity of most systems degrades as a result. For the first time, here is a set of techniques that facilitates composition of behavior that not only allows systems to be defined in terms of layered functionality but composition is at the very heart of the approach. This book is an important advance in modern methodology and is certain to influence the direction of software engineering in the next decade, just as Object-Oriented Software Engineering influenced the last." --Kurt Bittner, IBM Corporation"Use cases are an excellent means to capture system requirements and drive a user-centric view of system development and testing. This book offers a comprehensive guide on explicit use-case-driven development from early requirements modeling to design and implementation. It provides a simple yet rich set of guidelines to realize use-case models using aspect-oriented design and programming. It is a valuable resource to researchers and practitioners alike." --Dr. Awais Rashid, Lancaster University, U.K., and author of Aspect-Oriented Database Systems "AOSD is important technology that will help developers produce better systems. Unfortunately, it has not been obvious how to integrate AOSD across a project''s lifecycle. This book shatters that barrier, providing concrete examples on how to use AOSD from requirements analysis through testing." --Charles B. Haley, research fellow, The Open University, U.K. Aspect-oriented programming (AOP) is a revolutionary new way to think about software engineering. AOP was introduced to address crosscutting concerns such as security, logging, persistence, debugging, tracing, distribution, performance monitoring, and exception handling in a more effective manner. Unlike conventional development techniques, which scatter the implementation of each concern into multiple classes, aspect-oriented programming localizes them. Aspect-oriented software development (AOSD) uses this approach to create a better modularity for functional and nonfunctional requirements, platform specifics, and more, allowing you to build more understandable systems that are easier to configure and extend to meet the evolving needs of stakeholders. In this highly anticipated new book, Ivar Jacobson and Pan-Wei Ng demonstrate how to apply use cases--a mature and systematic approach to focusing on stakeholder concerns--and aspect-orientation in building robust and extensible systems. Throughout the book, the authors employ a single, real-world example of a hotel management information system to make the described theories and practices concrete and understandable. The authors show how to identify, design, implement, test, and refactor use-case modules, as well as extend them. They also demonstrate how to design use-case modules with the Unified Modeling Language (UML)--emphasizing enhancements made in UML 2.0--and how to achieve use-case modularity using aspect technologies, notably AspectJ. Key topics include Making the case for use cases and aspects Capturing and modeling concerns with use cases Keeping concerns separate with use-case modules Modeling use-cases slices and aspects using the newest extensions to the UML notation Applying use cases and aspects in projects Whatever your level of experience with aspect-oriented programming, Aspect-Oriented Software Development with Use Cases will teach you how to develop better software by embracing the paradigm shift to AOSD.

Engineering secure systems is an error-prone process, where any decision margin potentially favors critical implementation faults. To this end, formal security models serve as an abstract basis for verifying security properties. Unfortunately, the potential for human error in engineering and analyzing such models is still considerable. This work seeks to mitigate this problem. We identified semantic gaps between security requirements, informal security policies, and security models as a major source of error. Our goal is then based on this observation: to support error-minimizing design decisions by bridging such gaps. Due to the broad range of security-critical application domains, no single modeling framework may achieve this. We therefore adopt the idea of aspect-oriented software development to tailor the formal part of a security engineering process towards security requirements of the system. Our method, termed aspect-oriented security engineering, is based on the idea of keeping each step in this process well-defined, small, and monotonic in terms of the degree of formalism. Our practical results focus on two use cases: first, model engineering for operating systems and middleware security policies; second, model analysis of runtime properties related to potential privilege escalation. We eventually combine both use cases to present a model-based reengineering approach for the access control system of Security-Enhanced Linux (SELinux).

The LNCS journal Transactions on Aspect-Oriented Software Development is devoted to all facets of aspect-oriented software development (AOSD) techniques in the context of all phases of the software life cycle, from requirements and design to implementation, maintenance and evolution. The focus of the journal is on approaches for systematic identification, modularization, representation and composition of crosscutting concerns, i.e., the aspects and evaluation of such approaches and their impact on improving quality attributes of software systems. This volume, the 11th in the Transactions on Aspect-Oriented Software Development series, consists of two parts. The first part focuses on runtime verification and analysis, highlighting runtime verification as a "killer" application of aspect-orientation. The second part contains revised and extended versions of the five best papers submitted to Modularity:aosd 2013, presenting current research related to modularity and covering topics such as formal methods and type systems, static analysis approaches for software architectures, model-driven engineering and model composition, aspect-oriented programming, event-driven programming and reactive programming.

The Definitive Insider’s Guide to Auditing Software Security This is one of the most detailed, sophisticated, and useful guides to software security auditing ever written. The authors are leading security consultants and researchers who have personally uncovered vulnerabilities in applications ranging from sendmail to Microsoft Exchange, Check Point VPN to Internet Explorer. Drawing on their extraordinary experience, they introduce a start-to-finish methodology for “ripping apart” applications to reveal even the most subtle and well-hidden security flaws. The Art of Software Security Assessment covers the full spectrum of software vulnerabilities in both UNIX/Linux and Windows environments. It demonstrates how to audit security in applications of all sizes and functions, including network and Web software. Moreover, it teaches using extensive examples of real code drawn from past flaws in many of the industry's highest-profile applications. Coverage includes • Code auditing: theory, practice, proven methodologies, and secrets of the trade • Bridging the gap between secure software design and post-implementation review • Performing architectural assessment: design review, threat modeling, and operational review • Identifying vulnerabilities related to memory management, data types, and malformed data • UNIX/Linux assessment: privileges, files, and processes • Windows-specific issues, including objects and the filesystem • Auditing interprocess communication, synchronization, and state • Evaluating network software: IP stacks, firewalls, and common application protocols • Auditing Web applications and technologies