A Common Body of Knowledge for Engineering Secure Software and Services

The rapid development and expansion of network based applications have changed the computing world in the last decade. However, this overwhelming success has an Achilles’ heel: almost every software controlled system faces threats from potential adversaries both from internal and external users of the highly connected computing systems. These software systems must be engineered with reliable protection mechanisms, while still delivering the expected value of the software to their customers within the budgeted time and cost. The principal obstacle in achieving the above two different but interdependent objectives is that current software engineering processes do notprovide enough support for the software developers to achieve security goals. In this chapter, we reemphasize the principal objectives of both software engineering and security engineering, and strive to identify the major steps of a software security engineering process that will be useful for building secure software systems. Both software engineering and security engineering are ever evolving disciplines, and software security engineering is still in its infancy. This chapter proposes a unification of the process models of software engineering and security engineering in order to improve the steps of the software life cycle that would better address the underlying objectives of both engineering processes. This unification will facilitate the incorporation of the advancement of the features of one engineering process into the other. The chapter also provides a brief overview and survey of the current state of the art of software engineering and security engineering with respect to computer systems.

PurposeThe 2006 global common body of knowledge (CBOK) study is part of an ongoing research program that will broaden the understanding of how internal auditing is practised throughout the world. At the core of the 2006 CBOK study are three surveys of internal auditors worldwide regarding their professional activities. This paper reviews past CBOK studies and introduces the 2006 CBOK research project.Design/methodology/approachThe findings of prior CBOK studies are reviewed, and additional topics are identified to develop the topical areas to be covered in CBOK 2006.FindingsPast CBOK studies covered many of the same topical areas. Recent changes in The Institute of Internal Auditors Professional Standards, introduction of new technology, and the expanding complexity of business operations require new knowledge and skills for internal auditors. CBOK 2006 will be designed to address these issues.Originality/valueBy presenting an overview of past CBOK studies and discussing the rationale for the 2006 CBOK study, the researchers hope to motivate future research and to encourage internal auditors to participate in this global study.

A CBK for Information Security and Critical Information and Communication Infrastructure Protection

It has been reported in the literature that about twenty new software vulnerabilities are reported weekly. This situation has increased the security awareness in the software community. Nowadays, software services are expected not only to satisfy functional requirements but also to resist malicious attacks. As demand for more trustworthy systems is increasing, the software industry is adjusting itself to security standards and practices by increasing security assessment and testing effort. Even though there is a consensus that better software engineering is to improve software quality in the early stage of software development, so far, various approaches that have been proposed to analyze and quantitatively measure the software security target, primarily show the finished software products in their operational life. There are few achievements on how to reduce or effectively mitigate the security risks faced by software products during the development process. In this chapter, the authors introduce a novel model-driven perspective on secure software engineering, which integrates seamlessly software security analysis with traditional software development activities. A systematic security engineering process that starts in the early stages of the software development process and spans the entire software lifecycle is presented. Fundamental software security concepts and analysis techniques are also introduced, and several illustrative examples are presented, with focus on security requirements and risk analysis.

Information security is currently considered to be a crucial aspect of systems development. However it has traditionally been considered during the final stages of development, once the main components of the system have been developed and therefore provides solutions which are inappropriate for security integration. Software engineering has traditionally been separated from security engineering, and security issues have not usually been included in software engineering processes, activities, techniques, models, and so on. Furthermore, security engineering has not been aligned with information systems, and has focused rather on the definition of protocols, cryptographic algorithms, access control policies, etc. However, the scientific community is beginning to realize the importance of aligning software engineering and security engineering in order to develop more secure systems. Security in software engineering is a branch of research in which many contributions dealing with security integration from the early development stages have recently appeared. This chapter discusses some of the most interesting contributions in this area, and also provides a summary of our contributions through the development of various research lines dealing with different strategies to integrate security into information systems development as early in the development stages as is possible.

These days, if you say that you are doing research in the area of computer security you instantly receive attention. Sadly, the same cannot be said of software engineering. But are the two areas really so different? Both seem to be concerned with issues that range from the finely technical to the broadly social and that force us to make difficult tradeoffs among cost, performance, quality, and usability. Both seem to require that we conduct our research in an interdisciplinary context. In the end we realize that fully solving the security problem for ever larger and more complex systems is as intractable as fully solving the traditional software engineering problem.In this talk I will attempt to relate the challenges of security engineering and software engineering, and will argue that security engineering is more of a software engineering problem than many people would like to admit.

This article describes how to adapt a specific part of the Rational Unified Process (RUP) framework for the purpose of conducting requirements gathering for software projects aimed at adding security features to legacy software. The RUP seems particularly fitting for this purpose because it aggregates numerous software engineering terms into a common body of knowledge and strives to give them clear and unambiguous semantics. Furthermore, the RUP allows project coordinators to pick and choose only the process elements best suited to meet the particular needs of a project. The article should prove useful to project managers, process engineers, and software architects responsible for teaching old software new security functions. It should also prove useful to organizations that have already carried out basic software security projects such as those that fix buffer overflows, teach the software to perform better data validation, replace unsafe string handling functions, and recompile code with safe exception handling. This article covers only a small and very specific part of the RUP. It interprets the RUP in ways guided by the author's experience and specializes the Requirements discipline for use in projects tasked with adding new security features to legacy software.

Internal auditors have begun to shift from a traditional approach to risk-based approach. This article will review the previous literature on risk based audit approach, risk based audit plan and the forthcoming trends for internal audit tools and techniques (TTs) based on Common Body of Knowledge (CBOK) survey in 2007 and 2010. Based on surveys conducted by IIA in 2007 and 2010 the risk based audit plan continues to occupy the top position in the TTS used by internal auditors. It is argued that the risk-based audit plan will continue to be used by auditors in the future, because internal auditors conceive that if the internal audit plan is based on key risks that exist within the organization, it will enhance Chief Audit Executive (CAE)'s ability to match the audit plan to organizational needs..

The business college at the authors’ university embarked on a revised bachelor of science in business administration (BSBA) degree. The revisions to the degree focus on the common body of knowledge (CBK) courses that are required of all BSBA degree students. Primary goals of the revisions are enhanced teamwork activities, improved Enterprise Resource Planning (ERP) software knowledge, and increased integration of concepts among functional area courses. Two surveys at different times are administered to examine the impact of the program on teamwork and integration. The results show progress in achieving these goals for this revised degree program.

International comparisons of professional training in management accounting: The case of Canada and the United States

Vulnerability has become a popular though controversial topic in bioethics, notably since 2000. As a result, a common body of knowledge has emerged (1) distinguishing between different types of vulnerability, (2) criticizing the categorization of populations as vulnerable, and (3) questioning the practical implications. It is argued that two perspectives on vulnerability, i.e., the philosophical and political, pose challenges to contemporary bioethics discourse: they re-examine the significance of human agency, the primacy of the individual person, and the negativity of vulnerability. As a phenomenon of globalization, vulnerability can only be properly addressed in a global bioethics that takes the social dimension of human existence seriously.

Chapter 7 - Domain 7: Telecommunications and Network Security

1. Survivors: A Diverse Community with a Common Body of Knowledge

Intensive livestock farming has been linked to excessive pollution and contamination of land, water and air. A common body of knowledge is required in order to understand and assess this impact of agriculture, and take proper countermeasures with a focus on the sustainability and the protection of the physical environment, affecting agricultural productivity as little as possible. In this paper, we examine the problem of the environmental impact of livestock agriculture, targeting animal manure, which is a serious problem in various territories of Europe and the USA. Aiming to address this problem, we have developed AgriBigCAT, an online software platform that uses geophysical information from various diverse sources, employing geospatial and big data analysis, together with web technologies, in order to estimate the impact of the livestock agricultural sector on the environment, examining possible pollution of land, water and air, considering various scenarios and potential applications to mitigate the problem. The AgriBigCAT platform can assist both the farmers' decision-making processes and the administration planning and policy making, with the ultimate objective of meeting the challenge of increasing food production at a lower environmental impact.

How do you feel about learning to code? Investigating the effect of children’s attitudes towards coding using eye-tracking