TY - GEN
T1 - Goal-oriented security requirements analysis for a system used in several different activities
AU - Kaiya, Haruhiko
AU - Okubo, Takao
AU - Kanaya, Nobuyuki
AU - Suzuki, Yuji
AU - Ogata, Shinpei
AU - Kaijiri, Kenji
AU - Yoshioka, Nobukazu
PY - 2013
Y1 - 2013
N2 - Because an information system is used in different activities simultaneously today, we have to analyze usages of the system in the existing activities and to-be usages in an intended activity together. Especially, security aspects should be carefully analyzed because existing activities are not always secure. We propose a security requirements analysis method for resolving this problem. To take both existing and intended activities into account together, we integrate them on the basis of the unification of common actors. To explore possible attacks under integrated activities, we enumerate achievable attacks on the basis of the possible means in each actor with the help of security knowledge. To avoid or mitigate the attacks and to achieve fundamental goals, we disable some means or narrow down the means to be monitored with the help of propositional logic formulae. Through case studies on insurance business, we illustrated our idea.
AB - Because an information system is used in different activities simultaneously today, we have to analyze usages of the system in the existing activities and to-be usages in an intended activity together. Especially, security aspects should be carefully analyzed because existing activities are not always secure. We propose a security requirements analysis method for resolving this problem. To take both existing and intended activities into account together, we integrate them on the basis of the unification of common actors. To explore possible attacks under integrated activities, we enumerate achievable attacks on the basis of the possible means in each actor with the help of security knowledge. To avoid or mitigate the attacks and to achieve fundamental goals, we disable some means or narrow down the means to be monitored with the help of propositional logic formulae. Through case studies on insurance business, we illustrated our idea.
KW - Goal-Oriented Requirements Analysis
KW - Logic
KW - Security Requirements Analysis
KW - Strategic Dependency
UR - http://www.scopus.com/inward/record.url?scp=84879873991&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=84879873991&partnerID=8YFLogxK
U2 - 10.1007/978-3-642-38490-5_43
DO - 10.1007/978-3-642-38490-5_43
M3 - Conference contribution
AN - SCOPUS:84879873991
SN - 9783642384899
T3 - Lecture Notes in Business Information Processing
SP - 478
EP - 489
BT - Advanced Information Systems Engineering Workshops - CAiSE 2013 International Workshops, Proceedings
PB - Springer Verlag
T2 - 25th Conference on Advanced Information Systems Engineering, CAiSE 2013
Y2 - 17 June 2013 through 21 June 2013
ER -