Automated analysis of security requirements through risk-based argumentation
Journal article
Authors | Yu, Yijun, Franqueira, Virginia N. L., Than Tun, Thein, Wieringa, Roel J. and Nuseibeh, Bashar |
---|---|
Abstract | Computer-based systems are increasingly being exposed to evolving security threats, which often reveal new vulnerabilities. A formal analysis of the evolving threats is difficult due to a number of practical considerations such as incomplete knowledge about the design, limited information about attacks, and constraints on organisational resources. In our earlier work on RISA (RIsk assessment in Security Argumentation), we showed that informal risk assessment can complement the formal analysis of security requirements. In this paper, we integrate the formal and informal assessment of security by proposing a unified meta-model and an automated tool for supporting security argumentation called OpenRISA. Using a uniform representation of risks and arguments, our automated checking of formal arguments can identify relevant risks as rebuttals to those arguments, and identify mitigations from publicly available security catalogues when possible. As a result, security engineers are able to make informed and traceable decisions about the security of their computer-based systems. The application of OpenRISA is illustrated with examples from a PIN Entry Device case study. |
Keywords | Structured argumentation; Risk assessment; Security analysis |
Year | 2015 |
Journal | Journal of Systems and Software |
Publisher | Elsevier |
ISSN | 01641212 |
Digital Object Identifier (DOI) | https://doi.org/10.1016/j.jss.2015.04.065 |
Web address (URL) | http://hdl.handle.net/10545/555820 |
hdl:10545/555820 | |
Publication dates | 23 Apr 2015 |
Publication process dates | |
Deposited | 26 May 2015, 14:38 |
Rights | Archived with thanks to Journal of Systems and Software |
Contributors | University of Derby |
File | File Access Level Open |
https://repository.derby.ac.uk/item/9225x/automated-analysis-of-security-requirements-through-risk-based-argumentation
Download files
39
total views0
total downloads0
views this month0
downloads this month