Syntactic and Semantic Extensions to Secure Tropos to Support Security Risk Management - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Article Dans Une Revue Journal of Universal Computer Science Année : 2012

Syntactic and Semantic Extensions to Secure Tropos to Support Security Risk Management

Résumé

The need to consider security from the early stages of the development process of information systems has been argued by academics and industrialists alike, and security risk management has been recognised as one of the most prominent techniques for eliciting security requirements. However, although existing security modelling languages provide some means to model security aspects, they do not contain concrete constructs to address vulnerable system assets, their risks, and risk treatments. Furthermore, security languages do not provide a crosscutting viewpoint relating all three– assets, risks and risk treatments – together. This is problematic since, for a security analyst, it is difficult to detect what the potential security flaws could be, and how they need to be fixed. In this paper, we extend the Secure Tropos language, an agentand goal-oriented security modelling language to support modelling of security risks. Based on previous work, where we had observed some inadequacies of this language to model security risks, this paper suggests improvements of Secure Tropos semantics and syntax. On the syntax level we extend the concrete and abstract syntax of the language, so that it covers the security risk management domain. On the semantic level, we illustrate how language constructs need to be improved to address the three different levels of security risk management. The suggested improvements are illustrated with the aid of a running example, called eSAP, from the healthcare domain.
Fichier principal
Vignette du fichier
jucs_18_06_0816_0844_matulevicius.pdf (1.52 Mo) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-00718134 , version 1 (25-01-2021)

Identifiants

  • HAL Id : hal-00718134 , version 1

Citer

Raimundas Matulevicius, Haralambos Mouratidis, Mayer Nicolas, Dubois Eric, Patrick Heymans. Syntactic and Semantic Extensions to Secure Tropos to Support Security Risk Management. Journal of Universal Computer Science, 2012, 18 (6), pp.816-844. ⟨hal-00718134⟩
268 Consultations
120 Téléchargements

Partager

Gmail Facebook X LinkedIn More