Citation Context

...42] [43]. Using the idea of label propagation, different types of analysis could be performed early on before committing to an architecture or to code, as seen in the exploration of security concerns =-=[44]-=-, in visually choosing operationalizations [45], and in casting an i* model analysis as a SAT problem [46].On Non-Functional Requirements in Software Engineering 375 Eliciting requirements requires u...

Citation Context

...ecome a key challenge for Software Engineering [6, 8], and is the subject of this paper. Proposals for Security Requirements Engineering can be classified under one of two classes. Approaches such as =-=[3, 19, 25]-=- use an off-the-shelve modeling and analysis framework – such as UML, KAOS, or i*/Tropos – and model in that framework security requirements. For such approaches, the features of the framework are use...

Citation Context

...and Fox [54], followed independently by Sindre and Opdahl [70] and elaborated upon by Alexander [1], describe abuse and misuse cases, extending the use case paradigm to undesired behavior. Liu et al. =-=[53]-=- describe a method of analyzing possible illicit use of a system, but omit the important initial step of identifying the security requirements of the system before attempting to identify their violati...

Citation Context

...portance of considering security requirements in the development life cycle, but do not define them. Heitmeyer [12] shows how the SCR method can be used to specify and analyze security properties, without giving the criteria for distinguishing them from other system properties. A number of papers have focused on security requirements by describing how they may be violated. For example, McDermott & Fox [21], followed independently by Sindre & Opdahl [27] and elaborated by Alexander [1], describe abuse and misuse cases, extending the use case paradigm to undesired behavior. Liu, Yu & Mylopoulos [20] describe a method of analyzing possible illicit use of a system, but omit the important initial step of identifying the security requirements of the system before attempting to identify their violations. One could argue that Chivers and Fletcher [6] fall into this camp with SeDAn, as they focus on attackers and the paths they might take into a system. The problem with these approaches is that they indicate what a system is not to do in specific situations, but not in the general case. van Lamsweerde [18] describes a process by which security goals are made precise and refined until reaching s...

Citation Context

... actors, and enhance these with notions of trust and trust relationships. To this extent, Tropos - an agent-based software engineering methodology [4, 5] are particularly well suited. For example, in =-=[19, 20]-=- Liu et al. have shown how to use Tropos to model privacy and security concerns of an organization. However, in [13] the authors have shown that Tropos lacks the ability to capture at the same time th...

Citation Context

...ng access to information, and are applied to information assets or information to be garnered from physical assets (exposure). It should be noted that confidentiality is not the same thing as privacy =-=[10, 21]-=-; privacy incorporates as an additional concern the use one makes of an information asset, and is not discussed in this paper. Authentication is related to confidentiality, and is concerned with ensur...

Citation Context

...w approaches to the analysis and design of complex software systems. Examples of such frameworks are KAOS [1], the NFR framework [10], the i* framework [7], and Tropos [2]. Several approaches such as =-=[3, 5, 6, 16, 17, 18]-=- propose frameworks for modeling and analyzing security concepts by taking advantage of agent and goal oriented techniques. The majority of these approaches employ qualitative trade-off analysis, whil...

Citation Context

...2] security is frequently considered as a vague goal to be satisfied, while a precise description and enumeration of specific security properties and behavior is still missing. The work by Liu et al. =-=[41]-=- uses i*/Tropos for dealing with security and privacy requirements by introducing softgoal 1 , as “Security” or “Privacy”, to model these notions, and use dependencies analysis to check if the system ...