The increasing rates of cyber-attacks have led to the subsequent need to rapidly develop secure information systems (IS). Secure Tropos is an actor and goal-oriented approach to identify security goals and to enable s...
详细信息
ISBN:
(纸本)9783319258973;9783319258966
The increasing rates of cyber-attacks have led to the subsequent need to rapidly develop secure information systems (IS). Secure Tropos is an actor and goal-oriented approach to identify security goals and to enable security requirements elicitation. This is achieved by considering system actors, their dependencies and by deriving security constraints that actors need to satisfy. Nevertheless goal-oriented modelling has proven itself to be valid it also contains few shortcomings. One of them is the high granularity of the process, which leads quickly to high complexity models. Security patterns are proven to be reusable solutions that address recurring security problems. In this paper we investigate the integration of a pattern-based security requirements derivation from the Secure Tropos models.
This paper looks at enterprise interoperability (EI), specifically process-level interoperability, and suggests that the inherent non-determinacy of human-centred business processes introduces another ingredient into ...
详细信息
ISBN:
(纸本)9783662471579;9783662471562
This paper looks at enterprise interoperability (EI), specifically process-level interoperability, and suggests that the inherent non-determinacy of human-centred business processes introduces another ingredient into the EI puzzle that has thus far been understated in EIF ontologies. A conceptualisation of business process based on socio-technical concepts is presented. It is argued that this provides a better way to accommodate human agency factors, and under the influence of these factors, how business processes inevitably evolve over time, potentially affecting their interoperability. We suggest the extant body of knowledge on the theory of dynamic capabilities is relevant to understanding how organisations can control this potentially undirected process evolution and thereby sustain interoperability. Some initial observations are made concerning how this new ontological element could be accommodated into existing EIFs. The paper aims to stimulate discussion in this area and make a contribution to the EI body of knowledge.
In agile ontology-based software engineering projects support for modular reuse of ontologies from large existing remote repositories, ontology project life cycle management, and transitive dependency management are i...
详细信息
ISBN:
(纸本)9783319267623;9783319267616
In agile ontology-based software engineering projects support for modular reuse of ontologies from large existing remote repositories, ontology project life cycle management, and transitive dependency management are important needs. The contribution of this paper is a new design artifact called OntoMaven combined with a unified approach to ontology modularization, aspect-oriented ontology development, which was inspired by aspect-oriented programming. OntoMaven adopts the Apache Maven-based development methodology and adapts its concepts to knowledge engineering for Maven-based ontology development and management of ontology artifacts in distributed ontology repositories. The combination with aspect-oriented ontology development allows for fine-grained, declarative configuration of ontology modules.
Background: Aspect-Oriented Requirements Engineering (AORE) is a research field that aims to provide appropriate strategies for identification, modularization and composition of crosscutting concerns (also called earl...
详细信息
ISBN:
(数字)9783319223483
ISBN:
(纸本)9783319223483;9783319223476
Background: Aspect-Oriented Requirements Engineering (AORE) is a research field that aims to provide appropriate strategies for identification, modularization and composition of crosscutting concerns (also called early-aspects). Several AORE approaches have been developed recently, with different features, strengths and limitations. Goals: the aim of this paper is threefold: (i) cataloguing existing AORE approaches based on the activities encompassed by them;(ii) describing what types of techniques have been used by these approaches for "Concern Identification and Classification" - a bottleneck activity;and (iii) identifying which are the most used means of publication of AORE-based studies and how it has been the progress of these studies over the years. Results: we have selected and analyzed 60 (sixty) papers and among them, we identified 38 (thirty-eight) AORE distinct approaches. Some interesting results are: (i) few approaches lead to "Conflict Identification and Resolution", an activity responsible for discovering and treating the mutual influence between different concerns existing in a software;(ii) there is a lack of evaluation studies about already existing AORE approaches;(iii) the most productive research institutions on AORE in the world are located in Lancaster (UK) and Nova Lisboa (Portugal);among other.
Children nowadays start using Internet earlier and earlier. This has gained attention of scholars in various disciplines such as psychology, sociology, and media. Concerns about children's online safety have incre...
详细信息
ISBN:
(纸本)9783319217833;9783319217826
Children nowadays start using Internet earlier and earlier. This has gained attention of scholars in various disciplines such as psychology, sociology, and media. Concerns about children's online safety have increased but information Systems (IS) research on this area is still scarce despite of the fact that information security is an established research field within IS research. In this paper we review the existing research on children's online activities and related threats and risks, as well as initiatives to achieve online safety. We identify gaps in current research, such as lack of qualitative studies and research related to young children, and lack of research addressing the effectiveness of educational initiatives. We also argue that IS research should contribute to this research field for example by studying children's information security and privacy related behavior, as good information security skills lay the groundwork for privacy, the cornerstone for online safety.
Change requests are inevitable in every phase of the Software Development Life Cycle (SDLC), and responding to a change request without jeopardizing the project success remains a challenge for software developers/mana...
详细信息
ISBN:
(数字)9783319242859
ISBN:
(纸本)9783319242859;9783319242842
Change requests are inevitable in every phase of the Software Development Life Cycle (SDLC), and responding to a change request without jeopardizing the project success remains a challenge for software developers/managers. Expressing functional changes in terms of COSMIC Function Point units can be helpful in identifying changes leading to a potential impact on the software functional size;this latter can be used as a means to plan the project activities. This paper proposes to analyze the impact of functional changes on the size of UML activity diagrams, one artifact type produced early in the SDLC. The proposed analysis handles directly as well as indirectly affected elements in both modelling levels of the activity diagrams.
The Enterprise Architecture (EA) provides a holistic view of an enterprise and seeks to align the business and IT. As the change in the business goals and strategies of an enterprise is inevitable, managing the evolut...
详细信息
ISBN:
(纸本)9783319291338;9783319291321
The Enterprise Architecture (EA) provides a holistic view of an enterprise and seeks to align the business and IT. As the change in the business goals and strategies of an enterprise is inevitable, managing the evolution of the EA is a key challenge for modern enterprises. Furthermore, the EA metrics are instrumental in quantitatively measuring the progress of an enterprise towards its goals. The retrospective analysis of the EA metrics empower practitioners to take informed decisions while planning and selecting efficient alternatives to achieve the envisioned goal. The tool support for the EA metric analysis is still in its infancy. In this paper, we propose a model-based approach to capture the temporal aspects of the EA metrics and extend a model-based expression language to compute the EA metrics at any point of time in the past. This allows the visualization of the evolution of the EA metrics and as a consequence the evolution of the EA.
Today, it is a challenging task to keep a service application running over the internet safe and secure. Based on a collection of security requirements, a so-called golden configuration can be created for such an appl...
详细信息
ISBN:
(数字)9783319158952
ISBN:
(纸本)9783319158952;9783319158945
Today, it is a challenging task to keep a service application running over the internet safe and secure. Based on a collection of security requirements, a so-called golden configuration can be created for such an application. When the application has been configured according to this golden configuration, it is assumed that it satisfies these requirements, that is, that it is safe and secure. This assumption is based on the best practices that were used for creating the golden configuration, and on assumptions like that nothing out-of-the-ordinary occurs. Whether the requirements are actually violated, can be checked on the traces that are left behind by the configured service application. Today's applications typically log an enormous amount of data to keep track of everything that has happened. As such, such an event log can be regarded as the ground truth for the entire application: A security requirement is violated if and only if it shows in the event log. This paper introduces the ProMSecCo tool, which has been built to check whether the security requirements that have been used to create the golden configuration are violated by the event log as generated by the configured service application.
The emergence of cloud computing as a major trend in the IT industry signifies that corporate users of this paradigm are confronted with the challenge of securing their systems in this new environment. An important as...
详细信息
ISBN:
(数字)9783319192437
ISBN:
(纸本)9783319192437;9783319192420
The emergence of cloud computing as a major trend in the IT industry signifies that corporate users of this paradigm are confronted with the challenge of securing their systems in this new environment. An important aspect of that, includes the secure migration of an organization's legacy systems, which run in data centers that are completely controlled by the organization, to a cloud infrastructure, which is managed outside the scope of the client's premises and may even be to-tally off-shore. This paper makes two important contributions. Firstly, it presents a process (SMiLe2Cloud) and a framework that supports secure migration of corporate legacy systems to the cloud. We propose a process based on a continuous improvement cycle that starts with a Knowledge Discovery Meta-Model (KDM) set of models from which a security model for legacy system migration to the cloud is derived. Secondly, it provides a set of clauses (derived from the models) for security cloud providers and custom security cloud controls.
暂无评论