Modeling and Utilizing Security Knowledge for Eliciting Security Requirements

• DOI
• Slides

Abstract

In order to develop secure information systems with less development cost, it is important to elicit the requirements to security functions (simply security requirements) as early in their development process as possible. To achieve it, accumulated knowledge of threats and their objectives obtained from practical experiences is useful, and the technique to support the elicitation of security requirements utilizing this knowledge should be developed. In this paper, we present the technique for security requirements elicitation using practical knowledge of threats, their objectives and security functions realizing the objectives, which is extracted from Security Target documents compliant to the standard Common Criteria. We show the usefulness of our approach with several case studies.

Related papers

This work builds on

• Technical Meeting セキュリティターゲットを活用したセキュリティ機能要求獲得支援法 情報処理学会研究報告, 2015

BibTeX

@inproceedings{abe-mreba2015,
    author = {Tatsuya Abe and Shinpei Hayashi and Motoshi Saeki},
    title = {Modeling and Utilizing Security Knowledge for Eliciting Security Requirements},
    booktitle = {Proceedings of the 2nd International Workshop on Conceptual Modeling in Requirements and Business Analysis},
    pages = {236--247},
    doi = {10.1007/978-3-319-25747-1_24},
    year = 2015,
}