scholarly journals Arguing Satisfaction of Security Requirements

Author(s):  
C. B. Haley ◽  
R. Laney ◽  
J. D. Moffett ◽  
B. Nuseibeh

This chapter presents a process for security requirements elicitation and analysis, based around the construction of a satisfaction argument for the security of a system. The process starts with the enumeration of security goals based on assets in the system, then uses these goals to derive security requirements in the form of constraints. Next, a satisfaction argument for the system is constructed, using a problem-centered representation, a formal proof to analyze properties that can be demonstrated, and structured informal argumentation of the assumptions exposed during construction of the argument. Constructing the satisfaction argument can expose missing and inconsistent assumptions about system context and behavior that effect security, and a completed argument provides assurances that a system can respect its security requirements.

2008 ◽  
pp. 3199-3221
Author(s):  
C. B. Haley ◽  
R. Laney ◽  
J. D. Moffett ◽  
Bashar Nuseibeh

This chapter presents a process for security requirements elicitation and analysis, based around the construction of a satisfaction argument for the security of a system. The process starts with the enumeration of security goals based on assets in the system, then uses these goals to derive security requirements in the form of constraints. Next, a satisfaction argument for the system is constructed, using a problem-centered representation, a formal proof to analyze properties that can be demonstrated, and structured informal argumentation of the assumptions exposed during construction of the argument. Constructing the satisfaction argument can expose missing and inconsistent assumptions about system context and behavior that effect security, and a completed argument provides assurances that a system can respect its security requirements.


2021 ◽  
Author(s):  
KARTHIK GURUMURTHI

A symbolic logical framework (L) consisting of first order logic augmented with a causal calculus has been provided to formalize, axiomatize and integrate theories of design. L is used to represent designs in the Function-Behavior-Structure (FBS) ontology in a single, widely applicable language that enables the following: seamless integration of representations of function, behavior and structure; and generality in the formalization of theories of design. FRs, constraints, structure and behavior are represented as sentences in L. FRs are represented (as abstractions of behavior) in the form of existentially quantified sentences, the instantiation of whose individual variables yields the representation of behavior. This enables the logical implication of FRs by behavior, without recourse to apriori criteria for satisfaction of FRs by behavior. Functional decomposition is represented to enable lower level FRs to logically imply the satisfaction of higher level FRs. The theory of whether and how structure and behavior satisfy FRs and constraints is represented as a formal proof in L. Important general attributes of designs such as solution-neutrality of FRs, probability of satisfaction of requirements and constraints (calculated in a Bayesian framework using Monte Carlo simulation), extent and nature of coupling, etc. have been defined in terms of the representation of a design in L. The entropy of a design is defined in terms of the above attributes of a design, based on which a general theory of what constitutes a good design has been formalized to include the desirability of solution-neutrality of (especially higher level) FRs, high probability of satisfaction of requirements and constraints, wide specifications, low variability and bias, use of fewer attributes to specify the design, less coupling (especially circular coupling at higher levels of FRs), parametrization, standardization, etc..


Author(s):  
Manish Gupta

Information security is becoming increasingly important and more complex as organizations are increasingly adopting electronic channels for managing and conducting business. However, state-of-the-art systems design methods have ignored several aspects of security that arise from human involvement or due to human factors. The chapter aims to highlight issues arising from coalescence of fields of systems requirements elicitation, information security, and human factors. The objective of the chapter is to investigate and suggest an agenda for state of human factors in information assurance requirements elicitation from perspectives of both organizations and researchers. Much research has been done in the area of requirements elicitation, both systems and security, but, invariably, human factors are not been taken into account during information assurance requirements elicitation. The chapter aims to find clues and insights into acquisition behavior of human factors in information assurance requirements elicitation and to illustrate current state of affairs in information assurance and requirements elicitation and why inclusion of human factors is required.


2018 ◽  
Vol 60 (1) ◽  
pp. 3-20 ◽  
Author(s):  
Raimundas Matulevičius ◽  
Alex Norta ◽  
Silver Samarütel

Sign in / Sign up

Export Citation Format

Share Document