Details
| Original language | English |
|---|---|
| Pages (from-to) | 142-160 |
| Number of pages | 19 |
| Journal | Journal of Systems and Software |
| Volume | 139 |
| Early online date | 6 Feb 2018 |
| Publication status | Published - May 2018 |
Abstract
Security is an important and challenging quality aspect of software-intensive systems, becoming even more demanding regarding long-living systems. Novel attacks and changing laws lead to security issues that did not necessarily rise from a flawed initial design, but also when the system fails to keep up with a changing environment. Thus, security requires maintenance throughout the operation phase. Ongoing adaptations in response to changed security knowledge are inevitable. A necessary prerequisite for such adaptations is a good understanding of the security-relevant parts of the system and the security knowledge. We present a model-based framework for supporting the maintenance of security during the long-term evolution of a software system. It uses ontologies to manage the system-specific and the security knowledge. With model queries, graph transformation and differencing techniques, knowledge changes are analyzed and the system model is adapted. We introduce the novel concept of Security Maintenance Rules to couple the evolution of security knowledge with co-evolutions of the system model. As evaluation, community knowledge about vulnerabilities is used (Common Weakness Enumeration database). We show the applicability of the framework to the iTrust system from the medical care domain and hence show the benefits of supporting co-evolution for maintaining secure systems.
Keywords
- Co-evolution, Security impact analysis, Security requirements, Software design, Software evolution
ASJC Scopus subject areas
- Computer Science(all)
- Software
- Computer Science(all)
- Information Systems
- Computer Science(all)
- Hardware and Architecture
Cite this
- Standard
- Harvard
- Apa
- Vancouver
- BibTeX
- RIS
In: Journal of Systems and Software, Vol. 139, 05.2018, p. 142-160.
Research output: Contribution to journal › Article › Research › peer review
}
TY - JOUR
T1 - A framework for semi-automated co-evolution of security knowledge and system models
AU - Bürger, Jens
AU - Strüber, Daniel
AU - Gärtner, Stefan
AU - Ruhroth, Thomas
AU - Jürjens, Jan
AU - Schneider, Kurt
N1 - Publisher Copyright: © 2018 Elsevier Inc. Copyright: Copyright 2018 Elsevier B.V., All rights reserved.
PY - 2018/5
Y1 - 2018/5
N2 - Security is an important and challenging quality aspect of software-intensive systems, becoming even more demanding regarding long-living systems. Novel attacks and changing laws lead to security issues that did not necessarily rise from a flawed initial design, but also when the system fails to keep up with a changing environment. Thus, security requires maintenance throughout the operation phase. Ongoing adaptations in response to changed security knowledge are inevitable. A necessary prerequisite for such adaptations is a good understanding of the security-relevant parts of the system and the security knowledge. We present a model-based framework for supporting the maintenance of security during the long-term evolution of a software system. It uses ontologies to manage the system-specific and the security knowledge. With model queries, graph transformation and differencing techniques, knowledge changes are analyzed and the system model is adapted. We introduce the novel concept of Security Maintenance Rules to couple the evolution of security knowledge with co-evolutions of the system model. As evaluation, community knowledge about vulnerabilities is used (Common Weakness Enumeration database). We show the applicability of the framework to the iTrust system from the medical care domain and hence show the benefits of supporting co-evolution for maintaining secure systems.
AB - Security is an important and challenging quality aspect of software-intensive systems, becoming even more demanding regarding long-living systems. Novel attacks and changing laws lead to security issues that did not necessarily rise from a flawed initial design, but also when the system fails to keep up with a changing environment. Thus, security requires maintenance throughout the operation phase. Ongoing adaptations in response to changed security knowledge are inevitable. A necessary prerequisite for such adaptations is a good understanding of the security-relevant parts of the system and the security knowledge. We present a model-based framework for supporting the maintenance of security during the long-term evolution of a software system. It uses ontologies to manage the system-specific and the security knowledge. With model queries, graph transformation and differencing techniques, knowledge changes are analyzed and the system model is adapted. We introduce the novel concept of Security Maintenance Rules to couple the evolution of security knowledge with co-evolutions of the system model. As evaluation, community knowledge about vulnerabilities is used (Common Weakness Enumeration database). We show the applicability of the framework to the iTrust system from the medical care domain and hence show the benefits of supporting co-evolution for maintaining secure systems.
KW - Co-evolution
KW - Security impact analysis
KW - Security requirements
KW - Software design
KW - Software evolution
UR - http://www.scopus.com/inward/record.url?scp=85043281006&partnerID=8YFLogxK
U2 - 10.1016/j.jss.2018.02.003
DO - 10.1016/j.jss.2018.02.003
M3 - Article
AN - SCOPUS:85043281006
VL - 139
SP - 142
EP - 160
JO - Journal of Systems and Software
JF - Journal of Systems and Software
SN - 0164-1212
ER -