Security Requirements Engineering

A novel, model-driven approach to security requirements engineering that focuses on socio-technical systems rather than merely technical systems. Security requirements engineering is especially challenging because designers must consider not just the software under design but also interactions among people, organizations, hardware, and software. Taking this broader perspective means designing a secure socio-technical system rather than a merely technical system. This book presents a novel, model-driven approach to designing secure socio-technical systems. It introduces the Socio-Technical Modeling Language (STS-ML) and presents a freely available software tool, STS-Tool, that supports this design approach through graphical modeling, automated reasoning capabilities to verify the models constructed, and the automatic derivation of security requirements documents. After an introduction to security requirements engineering and an overview of computer and information security, the book presents the STS-ML modeling language, introducing the modeling concepts used, explaining how to use STS-ML within the STS method for security requirements, and providing guidelines for the creation of models. The book then puts the STS approach into practice, introducing the STS-Tool and presenting two case studies from industry: an online collaborative platform and an e-Government system. Finally, the book considers other methods that can be used in conjunction with the STS method or that constitute an alternative to it. The book is suitable for course use or as a reference for practitioners. Exercises, review questions, and problems appear at the end of each chapter.

Software Security Engineering draws extensively on the systematic approach developed for the Build Security In (BSI) Web site. Sponsored by the Department of Homeland Security Software Assurance Program, the BSI site offers a host of tools, guidelines, rules, principles, and other resources to help project managers address security issues in every phase of the software development life cycle (SDLC). The book’s expert authors, themselves frequent contributors to the BSI site, represent two well-known resources in the security world: the CERT Program at the Software Engineering Institute (SEI) and Cigital, Inc., a consulting firm specializing in software security. This book will help you understand why Software security is about more than just eliminating vulnerabilities and conducting penetration tests Network security mechanisms and IT infrastructure security services do not sufficiently protect application software from security risks Software security initiatives should follow a risk-management approach to identify priorities and to define what is “good enough”–understanding that software security risks will change throughout the SDLC Project managers and software engineers need to learn to think like an attacker in order to address the range of functions that software should not do, and how software can better resist, tolerate, and recover when under attack

The internet is established in most households worldwide and used for entertainment purposes, shopping, social networking, business activities, banking, telemedicine, and more. As more individuals and businesses use this essential tool to connect with each other and consumers, more private data is exposed to criminals ready to exploit it for their gain. Thus, it is essential to continue discussions involving policies that regulate and monitor these activities, and anticipate new laws that should be implemented in order to protect users. Cyber Law, Privacy, and Security: Concepts, Methodologies, Tools, and Applications examines current internet and data protection laws and their impact on user experience and cybercrime, and explores the need for further policies that protect user identities, data, and privacy. It also offers the latest methodologies and applications in the areas of digital security and threats. Highlighting a range of topics such as online privacy and security, hacking, and online threat protection, this multi-volume book is ideally designed for IT specialists, administrators, policymakers, researchers, academicians, and upper-level students.

Security threats are a significant problem for information technology companies today. This book focuses on how to mitigate these threats by using security standards and provides ways to address associated problems faced by engineers caused by ambiguities in the standards. The security standards are analysed, fundamental concepts of the security standards presented, and the relations to the elementary concepts of security requirements engineering (SRE) methods explored. Using this knowledge, engineers can build customised methods that support the establishment of security standards. Standards such as Common Criteria or ISO 27001 are explored and several extensions are provided to well-known SRE methods such as Si*, CORAS, and UML4PF to support the establishment of these security standards. Through careful analysis of the activities demanded by the standards, for example the activities to establish an Information Security Management System (ISMS) in compliance with the ISO 27001 standard, methods are proposed which incorporate existing security requirement approaches and patterns. Understanding Pattern and Security Requirements engineering methods is important for software engineers, security analysts and other professionals that are tasked with establishing a security standard, as well as researchers who aim to investigate the problems with establishing security standards. The examples and explanations in this book are designed to be understandable by all these readers.

Safety-Critical Systems (SCS) are increasingly present in people's daily activities. In the means of transport, in medical treatments, in industrial processes, in the control of air, land, maritime traffic, and many other situations, we use and depend on SCS. The requirements engineering of any system is crucial for the proper development of the same, and it becomes even more relevant for the development of SCS. Requirements Engineering is a discipline that focuses on the development of techniques, methods, processes, and tools that assist in the design of software and systems, covering the activities of elicitation, analysis, modeling and specification, validation, and management of requirements. The complete specification of system requirements establishes the basis for its architectural design. It offers a description of the functional and quality aspects that should guide the implementation and system evolution. In this book, we discuss essential elements of requirements engineering applied to SCS, such as the relationship between safety/hazard analysis and requirements specification, a balance between conservative and agile methodologies during SCS development, the role of requirements engineering in safety cases, and requirements engineering maturity model for SCS. This book provides relevant insights for professionals, students, and researchers interested in improving the quality of the SCS development process, making system requirements a solid foundation for improving the safety and security of future systems.

This book provides a coherent overview of the most important modelling-related security techniques available today, and demonstrates how to combine them. Further, it describes an integrated set of systematic practices that can be used to achieve increased security for software from the outset, and combines practical ways of working with practical ways of distilling, managing, and making security knowledge operational. The book addresses three main topics: (1) security requirements engineering, including security risk management, major activities, asset identification, security risk analysis and defining security requirements; (2) secure software system modelling, including modelling of context and protected assets, security risks, and decisions regarding security risk treatment using various modelling languages; and (3) secure system development, including effective approaches, pattern-driven development, and model-driven security. The primary target audience of this book is graduate students studying cyber security, software engineering and system security engineering. The book will also benefit practitioners interested in learning about the need to consider the decisions behind secure software systems. Overall it offers the ideal basis for educating future generations of security experts.

Healthcare and well-being have captured the attention of established software companies, start-ups, and investors. Software is starting to play a central role for addressing the problems of the aging society and the escalating cost of healthcare services. Enablers of such digital health are a growing number of sensors for sensing the human body and communication infrastructure for remote meetings, data sharing, and messaging. The challenge that lies in front of us is how to effectively make use of these capabilities, for example to empower patients and to free the scarce resources of medical personnel. Requirements engineering is the process by which the capabilities of a software product are aligned with stakeholder needs and a shared understanding between the stakeholders and development team established. This book provides guide for what to look for and do when inquiring and specifying software that targets healthcare and well-being, helping readers avoid the pitfalls of the highly regulated and sensible healthcare domain are and how they can be overcome. This book brings together the knowledge of 22 researchers, engineers, lawyers, and CEOs that have experience in the development of digital health solutions. It represents a unique line-up of best practices and recommendations of how to engineer requirements for digital health. In particular the book presents: · The area of digital health, e-health, and m-health · Best practice for requirements engineering based on evidence from a large number of projects · Practical step-by-step guidelines, examples, and lessons-learned for working with laws, regulations, ethical issues, interoperability, user experience, security, and privacy · How to put these many concerns together for engineering the requirements of a digital health solution and for scaling a digital health product For anybody who intends to develop software for digital health, this book is an introduction and reference with a wealth of actionable insights. For students interested in understanding how to apply software to healthcare, the text introduces key topics and guides further studies with references to important literature.

This State-of-the-Art Survey contains a selection of papers representing state-of-the-art results in the engineering of secure software-based Future Internet services and systems, produced by the NESSoS project researchers. The engineering approach of the Network of Excellence NESSoS, funded by the European Commission, is based on the principle of addressing security concerns from the very beginning in all software development phases, thus contributing to reduce the amount of software vulnerabilities and enabling the systematic treatment of security needs through the engineering process. The 15 papers included in this volume deal with the main NESSoS research areas: security requirements for Future Internet services; creating secure service architectures and secure service design; supporting programming environments for secure and composable services; enabling security assurance and integrating former results in a risk-aware and cost-aware software life-cycle.