UT Institute of Computer Science Graduation Theses Registry

Name

Anastasiia Onchukova

Abstract

Security concerns during development of secure information systems (IS) can be addressed at different development stages (e.g. requirements engineering, system and software de-sign, implementation, and other). Security analysis could be performed using different ded-icated modeling languages (e.g. Secure Tropos, misuse cases, mal-activity diagrams), what allows developers to express important concerns from the different perspectives. Although each language has its own strengths, combining different perspectives into the coherent and consistent model still remain a challenging activity. In the thesis we focus on the two modeling languages, called misuse cases (both di-agrams and textual templates) and mal-activity diagrams. Although being different in their development perspective, they both could potentially be used at the system and software design stages to elicit, analyze, and document security requirements. In the previous re-search both these languages were analyzed with respect to the domain model of the infor-mation systems security risk management (ISSRM), which determines a systematic process to identify important and valuable assets, determine their security risks and introduce secu-rity requirements to mitigate these risks. However in the previous work only the misuse case diagrams (not textual template, nor mal-activities) were completely extended with respect to the ISSRM domain model. The goal of this work is to define a thorough method, which would facilitate a transformation of the misuse cases to the mal-activities. Based on the aforementioned re-search in this thesis we extend the misuse case textual template and the mal-activity dia-grams, so that they would cover concepts of the ISSRM domain model. Next based on the extensions we introduce set of transformation rules that guides translation of the misuse cases diagrams with the help of the misuse case templates to the mal-activity diagrams. We validate our proposal in a case study on the analysis of the model quality. We hope that our contribution will help the system and software developers to integrate two modeling viewpoints in order to capture security requirements and systematically to devel-op and incorporate them into the system design, thus contributing to the secure IS.

Graduation Thesis language

English

Graduation Thesis type

Master - Software Engineering

Supervisor(s)

Raimundas Matulevičius

Defence year

2013