Formalized aspect-oriented misuse case for specifying crosscutting security threats and mitigations

Towards developing consistent misuse case models

A scientific evaluation of the misuse case diagrams visual syntax

Nowadays, it is impossible to ignore the implementation of security features in information systems since they manage important assets that are critical for the business processes of organizations. In this aspect, there have been several researches for introducing the security analysis in different stages of software development life cycle. Among those solutions, one of the most interesting one is the usage of misuse cases. Misuse cases, which are extensions of the well-known use cases, were created for defining security requirements. A misuse case can be considered as the inverse of a use case and it defines functions that the system should not allow. Even though, misuse cases are very useful for eliciting security requirements, they do not provide a mechanism to prioritize such requirements. Therefore, they do not address the problem of optimal risk management. Software engineers often have to work within a given set of budget constraints that may impede them from implementing all possible countermeasures. Thus, the software engineer needs to find a way to prioritize the security requirements to decide which requirements will be developed. Motivated by the mentioned limitation of misuse cases, the presented paper proposes an enhanced misuse case model which incorporates a method for prioritization of security requirements.

Software security testing is an important technique for discovering software vulnerabilities that violate security requirements. Existing security testing methods, however, seldom generate security tests directly from security requirements specifications. To address this issue, this paper presents an approach for constructing security test models from the artifacts of misuse case modeling (i.e., use/misuse cases and mitigation use cases), which is a popular method for security requirements specification in the software development process. The security test models can then be used to automatically generate security tests, which consist of test inputs (normal behaviors from use cases and attack actions from misuse cases) and test oracles from mitigation use cases. We have applied the approach to two case studies. One case study demonstrates that the proposed approach can build security test models in a structured fashion such that the generated security tests are as effective as reported in the literature. The second case study applies the proposed approach to an ongoing software development project. The security tests have revealed at least 24 vulnerabilities, and are very helpful for the development team to improve the security of the software implementation. This demonstrates that the proposed approach is effective in the software development process.

Secure software engineering is concerned with developing software systems that will continue delivering its intended functionality despite a multitude of harmful software technologies that can attack these systems from anywhere and at anytime. Misuse cases and mal-activity diagrams are two techniques to model functional security requirements address security concerns early in the development life cycle. This allows system designers to equip their systems with security mechanisms built within system design rather than relying on external defensive mechanisms. In a model-driven engineering process, misuse cases are expected to drive the construction of mal-activity diagrams. However, a systematic approach to transform misuse cases into mal-activity diagrams is missing. Therefore, this process remains dependent on human skill and judgment, which raises the risk of developing mal-activity diagrams that are inconsistent with the security requirements described in misuse cases, leading to the development of an insecure system. This paper presents an authoring structure for misuse cases and a transformation technique to systematically perform this desired model transformation. A study was conducted to evaluate the proposed technique using 46 attack stories outlined in a book by a former well-known hacker (Mitnick and Simon in The art of deception: controlling the human element of security, Wiley, Indianapolis, 2002). The results indicate that applying the proposed technique produces correct mal-activity diagrams from misuse cases.

Modeling Security and Privacy Requirements: a Use Case-Driven Approach

The idea of security aware system development from the start of the engineering process is generally accepted nowadays and is becoming applied in practice. Many recent initiatives support this idea with special focus on security requirements elicitation. However, there are so far no techniques that provide integrated overviews of security threats and system architecture. One way to achieve this is by combining misuse cases with use case maps into misuse case maps (MUCM). This paper presents an experimental evaluation of MUCM diagrams focusing on identification of vulnerabilities and mitigations. The controlled experiment with 33 IT students included a complex hacker intrusion from the literature, illustrated either with MUCM or with alternative diagrams. The results suggest that participants using MUCM found significantly more mitigations than participants using regular misuse cases combined with system architecture diagrams.

Use case diagrams is a popular early stage modeling notation for functional requirements, and misuse cases have similarly been explored for security and safety threats and requirements implied by these. One key goal of use case diagrams is simplicity, which make it possible to involve many types of stakeholders. Hence one wants to avoid including too much information in these diagrams. One type of information typically not included relates to the usage context, for instance what kind of equipment to be used to perform the use case. However, for multi-channel information systems, this is often highly relevant, and may in some cases make the diagrams clearer to stakeholders rather than more obscure, as long as the information is presented in a visually intuitive manner. This paper proposes some adapted notations to indicate what equipment is applied in use and misuse case diagrams.

e-Tendering is an electronic processing of the tender document via internet and allow tenderer to publish, communicate, access, receive and submit all tender related information and documentation via internet.This study aims to design the e-Tendering system using Rational Unified Process approach.RUP provides a disciplined approach on how to assign tasks and responsibilities within the software development process. RUP has four phases that can assist researchers to adjust the requirements of various projects with different scope, problem and the size of projects. RUP is characterized as a use case driven, architecture centered, iterative and incremental process model. However the scope of this study only focusing on Inception and Elaboration phases as step to develop the model and perform only three of nine workflows (business modeling, requirements, analysis and design). RUP has a strong focus on documents and the activities in the inception and elaboration phases mainly concern the creation of diagrams and writing of textual descriptions. The UML notation and the software program, Star UML are used to support the design of e-Tendering. The e-Tendering design based on the RUP approach can contribute to e-Tendering developers and researchers in e-Tendering domain.In addition, this study also shows that the RUP is one of the best system development methodology that can be used as one of the research methodology in Software Engineering domain related to secured design of any observed application.This methodology has been tested in various studies in certain domains, such as in Simulation-based Decision Support, Security Requirement Engineering, Business Modeling and Secure System Requirement, and so forth.As a conclusion, these studies showed that the RUP one of a good research methodology that can be adapted in any Software Engineering (SE) research domain that required a few artifacts to be generated such as use case modeling, misuse case modeling, activity diagram, and initial class diagram from a list of requirements as identified earlier by the SE researchers

To enjoy the full benefits of cloud computing, it is necessary to have built-in security, privacy, compliance and legal requirements for the cloud implementation and use. Each industry has its own risk levels that it could work within. A company, which is planning to use public cloud services, should be conscious of the regulations and industry risks and need to monitor it and abide by the same. This is due to multi-tenant and open to all nature of public cloud. A thorough risk analysis must be done initially with a public cloud provider. The main objective is to identify the existing vulnerabilities and to implement the measures to counter those threats. There are a variety of risks such as vendor lock-in, non-compliance, poor provisioning, unauthorized access, loss of control, Service Level Agreement (SLA) violations, Internet attacks, etc. To alleviate the risks, there are several measures that could be deployed. This paper deals with mitigation mechanism, security requirements and various risks associated with public cloud.

As interests in security increases, several software development lifecycle considering security have been proposed. Actual results of applying software development lifecycle considering security reduced threats have been reported. But to apply software development lifecycle considering security, requires expertise and experiences. In this paper a secure software development lifecycle applying integrated secure guide is proposed. Secure Guides such as Misuse Case, Security Patterns and Secure Coding are integrated in the proposed method. And then, by applying integrated Secure Guide in each software development phase, the security becomes available in every phase of software development. Since, proposed secure guide provides more security information than available secure guides, software developer can use more security information while they are developing software. As a result, it is expected that developers could consider security more easily when developing software even though developers lacks expertise in security or experience.

Security is now the most critical feature of any computing systems. Eliciting and analyzing security requirements in the early stages of the system development process is highly recommended to reduce security vulnerabilities which might be found in the later stages of the system development process. In order to address this issue, we will propose a new extension of the misuse case diagram for analyzing and eliciting security requirements with special focus on assets and security goals. We will also present the process model in which business requirements and system requirements related to security features are separately analyzed and elicited in different phases. This process model helps us to analyze the requirements related to business goals in an earlier phase and to the system goals in a later phase so that any concerns related to them are dealt with separately. We will illustrate our approach with a case study taken from an accounting software package.

Given the wide distribution of software and its current growth, security is inevitable, and software systems have become more complex. To avoid the complexity and protect valuable assets of software systems, researchers, and practitioners in the fields of security requirement engineering (SRE) and security assurance advise incorporating security requirements early in software development life cycle (SDLC). Nowadays, security requirements specification and identification are an active research area for ensuring the effectiveness of software systems. However, security requirement identification is a challenging task due to sheer numbers of threats and attacks to a software system. Previous researchers have identified different SRE techniques, each looking at the same problem from a different perspective. Therefore, a literature review conducted on SRE techniques. We compared and analyzed different SRE techniques to find the most suitable SRE techniques for researchers and practitioners. Selected SRE techniques compared based on various parameters, such as different attributes, requirement elicitation, requirement analysis, project size, and integration of standards. The literature also indicates that among SRE approaches, security quality requirements engineering (SQAURE), secure tropos, security requirements engineering process (SREP), and comprehensive lightweight application security process (CLASP) are the most used SRE approaches that focus on activities such as threats, security requirements identification, and security objectives identification. Unfortunately, several SRE approaches fail to explicitly integrate the security standard and security assurance perspective. Three questions developed for this study: Question 1 is based on comparison of existing SRE approaches, Question 2 is based on SRE with security requirements elicitation and analysis, and Question 3 highlights the incorporation of security requirements assurance by SRE approaches implicitly or explicitly. The researcher must work with the developer to easily adopt SRE approaches to elicit and ensure security requirements for the software system.

The last decade has seen several aspect language proposals for UML 2 sequence diagrams. Aspects allow the modeler to define crosscutting concerns of sequence diagrams and to have these woven with the sequence diagrams of a so-called base model, in order to create a woven model. In a real-world scenario, there may be multiple aspects applicable to the same base model. This raises the need to analyse the set of aspects to identify possible aspect interactions (dependencies and conflicts) between applications of aspects. We call a set of aspects terminating if they may not be applied infinitely many times for any given base model. Furthermore, we call a set of terminating aspects confluent, if they, for any given base model, always yield the same final result regardless of the order in which they are applied. Since confluence must hold for any base model, this is a much stronger result than many of the current approaches that have addressed detection of aspect interactions limited to a specific base model. Our aspects are specified using standard sequence diagrams with some extensions. In this paper, we present a confluence theory specialized for our highly expressive aspect language. For the most expressive aspects, we prove that confluence is undecidable. For another class of aspects with considerable expressiveness, we prescribe an algorithm to check confluence. This algorithm is based on what we call an extended critical pair analysis. These results are useful both for modelers and researchers working with sequence diagram aspects and for researchers wanting to establish a confluence theory for other aspect-oriented modelling or model transformation approaches.

The article focuses on studying and implementing a method of assigning access rights to the applications in a corporate mobile network with different requirements for security, which will allow considering the specific activities of multiple users. The existing solutions for assigning access rights to applications and services of the intranet are analyzed, the need to create a method that ensures information security when implementing access in corporate networks with different requirements for the level of security is substantiated. Due to the results of analysis of trends and development prospects of modern corporate mobile networks there has been found a contradiction between the requirements for information security of universal mobile devices with access to secure services and technical capabilities of information security systems that ensure access security in the corporate networks with different security requirements. To solve the problem, a multi-user system has been implemented that ensures operation of any computer equipment and mobile devices of an organization whose DBMS has a client-server architecture. The functional requirements for the developed method include the ability to perform user authorization, providing the administrator with the ability to manage user access rights to various applications, managing application storage, recording user operations, and keeping records. In the course of the software implementation of the method of assigning access rights, the design of the database is described in stages, a model of information flows is built, a physical diagram of the interaction of individual procedures is considered, on the basis of which the database is created, a user interface with forms that display information stored in the database is developed.