Abstract:Security requirements analysis for business information systems in today's networked organization is difficult due to the complexity of the systems and the frequent change in the environment. Thus, it requires security knowledge to be explicitly represented, and well understood by system analysts and designer, which in turn being applied in feasible problem contexts. System requirements are often represented in modelling frameworks with different analytical focus, so security requirements knowledge shall reflect such difference and form an integrated treatment. This paper proposes to use modelling concepts from the i* and PF modeling language to capture recurring patterns of security problems. The main concepts used are actors, assets, and relations such as ownership and permissions. The major contribution of the approach is proposing the specific problem frames such as ownership, authorization, attack and protection, by decomposing a large problem into sub-problems (base frames), then evaluate the potential threats (attacking frames) applicable to each sub-problem by evaluate the compatibility of the two, security analysis is integrated into the system design process from the outset. The proposal can be generalized to the design of defensive measures as well as other NFR treatments. © 2011 IEEE.

A Business Process-based Method on Security Requirement Analysis of Information Systems

Analysis on security objectives of business process elements

Business Activity-Oriented Security Model of Information Systems

Research on Information Security Model and Security System Design

Analysing security requirements patterns based on problems decomposition and composition.

Business Process Status-Based Risk Analysis

A Real Time Information Security Risk Assessment Method

Analysis and Comparison of Existing Security Design Methods for Power Information System

A Business Goal Driven Approach for Understanding and Specifying Information Security Requirements

BPEL Based Method for General Security Control Module Design

Study on information system risk assessment method

Business Activities Status-Based Risk Assessment Research

Security Design Based on Social Modeling

Power Information Systems Security: Modeling and Quantitative Evaluation

Service Security Analysis Based on i*: An Approach from the Attacker Viewpoint

Analysis Method of Security Critical Components of Industrial Cyber Physical System Based on SysML.

Security Requirements Engineering in the Wild: A Survey of Common Practices

Security Risk Assessment and Weaknesses Identification of the Substation Automation System

Security Policies for WFMS with Rich Business Logic - A Model Suitable for Analysis

A Business Process-Driven Approach for Requirements Dependency Analysis

The Security System Analysis of Teaching and Researching Management System Based on Audit Strategy