Reuse in SRE Final

33 Pages·2015·1.35 MB·English

RequirementsEng
DOI10.1007/s00766-015-0220-8
ORIGINAL ARTICLE
Reusable knowledge in security requirements engineering:
a systematic mapping study
Amina Souag • Rau´l Mazo • Camille Salinesi •
Isabelle Comyn-Wattiau
Received:31January2014/Accepted:14January2015
(cid:2)Springer-VerlagLondon2015
Abstract Security is a concern that must be taken into (3)previoussurveyswereupdated.Weconcludethatmost
consideration starting from the early stages of system de- methods should introduce more reusable knowledge to
velopment. Over the last two decades, researchers and manage security requirements.
engineers have developed a considerable number of
methods for security requirements engineering. Some of Keywords Reusability (cid:2) Security requirements (cid:2)
them rely on the (re)use of security knowledge. Despite Knowledge (cid:2) Ontologies (cid:2) Patterns (cid:2) Templates
some existing surveys about security requirements engi-
neering, there is not yet any reference for researchers and
practitioners that presents in a systematic way the existing 1 Introduction and motivation
proposals, techniques, and tools related to security
knowledgereuseinsecurityrequirementsengineering.The There is a clear trend nowadays to consider systems se-
aimofthispaperistofillthisgapbylookingintodrawing curity at the requirements engineering stage. Formerly,
a picture of the literature on knowledge and reuse in se- securityrequirementswereconsideredastechnicalchoices
curity requirementsengineering. Thequestionswe address made during implementation, resulting in late and expen-
are related to methods, techniques, modeling frameworks, sive attempts to shoehorn security into the system in pro-
and tools for and by reuse in security requirements engi- gress. This is particularly true with information systems
neering. We address these questions through a systematic (IS). Security requirements engineering (SRE) allows IS
mappingstudy.Themappingstudywasaliteraturereview developers to predict the threats, their consequences and
conducted with the goal of identifying, analyzing, and countermeasuresbeforeasystemisinplace,ratherthanas
categorizing state-of-the-art research on our topic. This a reaction to possibly disastrous attacks [1]. SRE is con-
mapping study analyzes more than thirty approaches, cerned with protecting assets from harm [2]. To cope with
covering 20 years of research in security requirements these issues, an increasing number of publications, con-
engineering. The contributions can be summarized as fol- ferencetracks,andworkshopsinrecentyearspointoutthe
lows: (1) A framework was defined for analyzing and growing interest of researchers and practitioners in pro-
comparing the different proposals as well as categorizing viding SRE processes with various frameworks and
future contributions related to knowledge reuse and secu- methods. Some of them are extensions of goal-oriented
rity requirements engineering; (2) the different forms of approaches, like secure i* [3], secure tropos [4], KAOS,
knowledge representation and reuse were identified; and and anti-models [5]. Others are built on the object para-
digm, mainly UML-based, such as misuse cases [6], se-
curity use cases [7], secure UML [8], and UMLSec [9].
A.Souag(&)(cid:2)R.Mazo(cid:2)C.Salinesi Atahighlevelofabstraction,everyapplicationtendsto
CRI,Panthe´onSorbonneUniversity,Paris,France have the same basic kinds of vulnerable assets (e.g., data,
e-mail:[email protected]
communications, services, hardware components, and
personnel). Similarly, these vulnerable assets tend to be
I.Comyn-Wattiau
CEDRIC-CNAM&ESSECBusinessSchool,Paris,France subject to the same basic kinds of security threats (e.g.,
123
RequirementsEng
theft, vandalism, unauthorized disclosure, destruction, results and answers of the research questions. Section 6
fraud, extortion, and espionage) from attacks by the same reports the related works. Section 7 discusses threats to
basickindsofattackers(e.g.,hackers,crackers,disgruntled validity of our mapping study. Finally, Sect. 8 concludes
employees, international cyber terrorists, and industrial this paper.
spies) who can be profiled with motivations and their
typical levels of expertise and tools. Furthermore, security
requirements tend to be even more standardized than their 2 Knowledge reuse in security requirements
associated mechanisms. For example, to address the iden- engineering
tification and authentication requirements, one may have
several choices of architectural mechanisms beyond user Back in 1993, the second International Workshop on
ID and passwords [10]. Based on these facts, reuse of re- Software Reusability was held inLucca, Italy. Most of the
quirements could lead to significant savings in develop- papers presented at this event focused on reusing code,
ment time and cost [11]. Nowadays, the research design, or architecture. In other words, the thinking was
communityinSREaswellaspractitionershasavagueidea that mainly the hard artifacts—code, object, and so on—
of existing literature for handling knowledge reuse among could be reused. Very few papers looked at the idea of
existing SRE approaches. For instance, a quick research reuse earlier in the IS life cycle, namely reusing require-
indicates that some of the approaches propose a catalog of ments themselves. Active areas of reuse research in the
attacks[12],whileothersrelyonpatterns[13].However,a past 20 years include reuse libraries, domain engineering
systematic mapping studyand analysis ofexisting security methods and tools, reuse design, design patterns, domain-
requirements engineering methods that make (re)use of specific software architecture, software componentry [14],
knowledge is still lacking. generators, measurement, and experimentation [15].
Thispaperpresentsastructuredandsystematicmapping Nowadays, the practice of reuse is moving upstream,
study of several articles related to knowledge reuse and and reuse is also concerned with more abstract artifacts.
security requirements engineering from the last two Requirements are commonly recycled; patterns are ex-
decades. changed on the Internet. The notion of reuse at the re-
The goals of this research can be summarized as fol- quirements stage is largely accepted by many within the
lows: (1) to update existing literature surveys related to communityasadesirableaim[16].Forinstance,aworking
SRE with recent researches, (2) to identify the (re)used conferenceon patterns (PatternLanguagesofPrograms)is
knowledgeinSRE,(3)todistinguishthedifferenttypesof held twice a year and results in the sharing of knowledge
knowledge reuse structures in SRE, and (4) to understand and publication of new patterns [17].
theiruse.Ourresearchmethodconsidersthestateoftheart Requirement reuse can be defined as either taking re-
in security requirements literature. More specifically, this quirementsthathavebeenwrittenforpreviousprojectsand
mapping study must find answers to the following ques- thenusingthem foranewproject,orwritingrequirements
tions: Do the security requirements engineering methods from scratch at a reasonable level of generality and ab-
rely on reusability of knowledge? What are the reusable straction in order to use them over different projects. For
elements? How are they represented, modeled? How are instance, it is possible to reuse different types of data,
they (re)used? Are the knowledge-based approaches tool ranging from business requirements and functional re-
supported? quirements to use cases and test cases. Since requirements
A framework was defined to understand the different engineering is the first phase in the software development
proposalsandclassifynewcontributionsinthefuture.Over process, requirements reuse can empower the software life
100proposalswere analyzed fromwhich the paperreports cycle. Previous research [18] has pointed out that reusing
the knowledge reuse situation of 30 methods. the first software products and processes implemented in a
The main target audiences of this mapping study are development project can have an impact on the life cycle
researchers and especially Ph.D. students in the field of from two basic points of view: (a) allowing the software
security requirements, but also tool developers or practi- development resources to be more profitable and (b) pro-
tioners who are interested in the field. motingreuse-baseddevelopmentacrosstheentiresoftware
The paper is structured as follows. Section 2 presents a process.
short introduction to knowledge reuse in security require- During the last decade, given the common nature of
ments engineering. Section 3 gives an overview of our security problems across applications and application do-
researchmethod.Section 4presentstheprocessandresults mains, researchers paid some attention to the benefits of
of the conducted systematic mapping study to get an reuse in SRE process [10]. Security knowledge is hard to
overview of existing security requirements approaches acquire. In addition to awareness about potential attacks,
based on knowledge reuse. Section 5 summarizes the designingsecurity-criticalsystemsrequiresknowledgeand
123
RequirementsEng
security expertise in various fields such as computer net- performedbasedontheseguidelines(cf.Fig. 1),toidentify
works, operating systems, communication protocols, questionsandanswersraisedbytheresearchcommunityon
cryptography algorithms, and access control methods. knowledge (re)use in SRE.
Reuse combined with pre-defined structured knowledge Reviewing existing research in a fully objective way is
can make the job of requirements engineers much easier not possible. A systematic study, such as the one outlined
and faster, since they usually lack security expertise and in Fig. 1, however, makes the process less subjective by
skills. However, one should be careful when structuring using pre-defined data forms and criteria that narrow the
reusable knowledge—it has to be of a high quality. scope for personal interpretation.
Otherwise, it might end up introducing new security Mapping studies must be distinguished from systematic
problems. A clear distinction must be made between literature reviews in several ways. Systematic literature
engineering ‘‘for’’ reuse and engineering ‘‘by’’ reuse [19]. reviews (SLR) have been defined as ‘‘a means of identi-
Structuring security knowledge helps the knowledge fying, evaluating, and interpreting all available research
consumer to browse the content and to find the relevant relevant to a particular research question, or topic area, or
information more efficiently. Different knowledge repre- phenomenon of interest’’ [22]. Mapping studies are a spe-
sentations exist in the literature. Patterns of recurring at- cial kind of SLR that use the same basic methodology as
tacks and vulnerabilities have been identified by longtime SLRsbutaimtoidentifyandclassifyallresearchrelatedto
softwaresecuritypractitioners[20].Securitytemplatesofa a broad software engineering topic rather than answering
high level of abstraction were also introduced for reuse questions about the relative merits of competing tech-
purposes [10]. Various other approaches for managing se- nologies as addressed by conventional SLRs [23, 24].
curity knowledge and reuse exist in the literature, such as SMAPsareintendedtoprovideanoverviewofatopicarea
taxonomies, ontologies, standards, and guidelines. and identify whether there are sub-topics with sufficient
primary studies to conduct conventional SLRs and also to
identifysub-topicswheremoreprimarystudiesareneeded.
3 Research method Overall, the main phases of our systematic mapping
study were: defining research questions, conducting the
A fair amount of publications, conference tracks, and search for relevant papers, screening papers, key wording
workshops in SRE appeared during the last decade, re- of abstracts, extracting data, planning mapping, conduct-
vealing a steady interest of both researchers and practi- ing, and reporting. Figure 1 presents the process structure
tionersinthatdomain.Unfortunately,itremainsdifficultto of our SMAP.
have more than a vague idea about what is available in A key element, in the guidelines proposed by Petersen
terms of reuse of security requirements and to position et al. [21], is the definition of the research questions (re-
research with respect to available practices in order to search scope). Research questions should reflect and reply
choose appropriate practice. One difficulty is due to the tothemaingoalsofaSMAPinprovidinganoverviewofa
factthattheseissuesareaddressedbyseveralcommunities: researcharea,identifythequantityandtypeofresearchand
the requirements engineering community, the software results available within it. The search for primary studies
engineering community, the information systems commu- (all papers) is conducted thanks to search strings on sci-
nity, and the computer security community. entific databases or browsing manually through relevant
Ourresearchmethodaimedatanalyzingandidentifying conference proceedings or journal publications. We per-
the available literature on security requirements research formed screening of papers for inclusion and exclusion
and categorizing it in a systematic way. The systematic (relevant papers). In this step, inclusion and exclusion
mAPping study (SMAP) was conducted between August criteria are used to exclude studies that are not relevant to
2013andDecember2013.Weappliedthemappingstudies answertheresearchquestions.Keywordingusingabstracts
guidelines proposed by Petersen et al. [21], which com- is a way to reduce the time needed in developing the
pares the methods used in mapping studies and systematic classification scheme and ensuring that the scheme takes
literature reviews. The SMAP reported in this paper was theexistingstudiesintoaccount.Theprocessendsupwith
Fig.1 Systematicmapping
processcarriedoutinthispaper,
appliedfrom[21]
123
RequirementsEng
the data extraction and mapping of studies; here, the which knowledge is currently reused, and RQ6 sketches
classification scheme evolves by adding new categories or avenues for our future research. Thus, our systematic re-
mapping and splitting existing categories. More practical view was guided by the following research questions, for
detailsonhowweaddressedtheseissuesinourSMAPare each SRE method, and for SRE methods overall:
given in the next section.
RQ1. Does the security requirements engineering
methodrelyonreusablesecurityknowledge?Howmany
papers handled knowledge reuse in SRE? (Knowledge
4 Reusable security knowledge: a systematic mapping
reliance)
study
RQ2. How is the reused knowledge represented? What
are the proportions of each knowledge representation
The review includes publications reporting on existing
form? (Form of representation)
approaches and tools as well as publications discussing
RQ3. What are the techniques for (re)using the knowl-
research issues for security requirements and knowledge
edge and their proportion? (Technique)
reuse in SRE. The SMAP was conducted in 24 relevant
RQ4. What are the main reused elements and their
sources(thedetailedlistofthesourcescanbeconsultedin
proportion? (Reusable knowledge)
the cell ‘‘Digital library/resource’’ in Table 4 in the ‘‘Ap-
RQ5.Isittoolsupported?AretheremanytoolsforSRE
pendix’’).Thetotalretrievednumberofpublicationsis158
overall? (Automation)
using well-defined search criteria (which will be presented
RQ6. What are the new challenges regarding security
later).Fromthese158publications,95paperswerechosen
knowledge (re)use in SRE?
for further analyses based on our set of selection criteria.
The complete list of all 95 retrieved publications and de- Research question RQ1 checks, among the different
tails about the retrieved searches can be found in the existing proposals, whether the security engineering
‘‘Appendix’’ (Table 4). method at hand relies on the (re)use of knowledge. It also
looks for the number of papers that rely on the (re)use of
4.1 Conducting the systematic mapping study knowledge. RQ2 finds how (and how much) the (re)used
knowledge is represented (modeling language, representa-
The main goal for conducting the systematic mapping tionofrequirements,etc.).RQ3identifieshowthesecurity
study was to get an extensive overview of existing knowledgeis(re)used.RQ4reportswhatthemainreusable
knowledge-based approaches and tools for security re- elements found in proposals identified in RQ1 are: for in-
quirements engineering and to understand key issues for stance, security requirements, threat models, or common
security requirements elicitation and analysis considering vulnerabilities. RQ5 checks whether the SRE method of-
the(re)useofknowledgeinthesepractices.Thissystematic fers automated support for the reuse of knowledge. It also
mapping study was developed using the following examinesthenumberofpapersthatproposetoolsforreuse
elements: in SRE. Finally, RQ6 extracts from the papers some new
challenges that the SRE community should face in the
4.1.1 Definition of research questions future.
Ourpreviousresearchledustotheconclusionthatweneed 4.1.2 Search for primary studies
toreinforcesecurityrequirementsengineeringbyenriching
the process with specific knowledge on security. This To search for primary studies (all papers), the sources
knowledge is necessary to take into account security re- (presented in the ‘‘Appendix’’) were selected based on an
quirements early and consistently. It is generally not well analysis of security requirements literature. Our sources
known by information systems designers. Hence, we want were extracted from digital libraries such as ACM Digital
tounderstandthecurrentstateoftheartinthisfield.More Library, Science Direct, IEEE Xplore, IEEE Computer
specifically, we want to evaluate whether the security Society, SpringerLink and DBLP; we chose those because
knowledge can be reused (RQ1). A deep analysis of this our university had a subscription to them. Also journals,
question requires that we elicit how this knowledge is conferences, and workshops of the domain such as RE,
represented (RQ2) and reused (RQ3). Moreover, can the REFSQ, ARES, and Requirements Engineering Journal
whole knowledge be reused (RQ4)? Can it be reused au- were considered. These sources were chosen based on a
tomatically (RQ5)? Finally, what can be improved in cur- pre-search on Google Scholar inaddition toconsulting the
rent approaches (RQ6)? RQ2, RQ3, RQ4, RQ5, and RQ6 citations of existing SLRs and other SMAPs. Relevant
only makesense ifRQ1 isanswerableand ifthe answer is books and reports were explored further. For all primary
yes.RQ2,RQ3,RQ4,andRQ5arenecessarytounderstand studies found in these sources, we also followed their
123
RequirementsEng
relevant cited references to find additional contributions Ninety-five searches in 24 sources were carried out us-
outside the above-mentioned subset. All searches have ing the search terms described above. In total, 158 publi-
been conducted on publications appeared between 2000 cations were retrieved, out of which 21 were found not
and 2013, thus covering over 13 years of SRE research. directly in the 24 sources but by following relevant cited
Dependingonthesource,differentsearchtermswereused. references. Figure 2 shows the distribution of research re-
Forthemoregeneral conferences and for journals, we used sultsrelatedtosecurityrequirementsengineeringandreuse
the search terms ‘‘reuse security requirements,’’ between 2000 and 2013. The figure also shows that be-
‘‘knowledge security requirements,’’ ‘‘reusa- tween2004and2007,agreatnumberofpublicationswere
bilityinsecurityrequirements,’’or‘‘knowl- published; thus, the well-known approaches for security
edge reusability security requirements’’ requirements engineering appeared in this period. Table 4
appearing in the fulltextofthepublications (excludingref- (in the ‘‘Appendix’’) presents the retrieved and selected
erences). In conferences and journals related to SRE, the publications for each source.
searchtermwasiterativelyrefined,forexampleleadingtothe
searchterms‘‘ontologiesforsecurityrequire- 4.1.4 Data classification
ments,’’ ‘‘pattern security requirements,’’
‘‘reuse misuse cases,’’ ‘‘knowledge security Theretrievedpublicationswerefirstanalyzedregardingthe
usecases,’’or‘‘reusesecuretropos.’’ restrictions R1–R2. The remaining publications were
carefully assessed regarding quality criterion Q1. For each
retrieved publication, the following standard information
4.1.3 Screening of papers
was collected in a data extraction form:
Search for primary studies lead to 158 articles, many of • Date of search, source, and used search term.
which were irrelevant. Screening for papers based on the • Authors, title, and publication year.
title and succinct review of the abstract, in addition to the • Type of publication (conference, workshop, journal,
reliance on our inclusion and exclusion criteria, reduced report, or book).
the number of relevant papers. The screening process was • Shortsummary(mainclaims,presentedapproach/tool).
performedbytwooftheauthors(team1)andvalidatedby • Restrictions R1, R2 (yes or no)?
the other two authors (team 2). • Quality criteria Q1, Q2, Q3, Q4 fulfilled (yes or no)?
The following restrictions and quality criteria for in- • Addressed research question(s).
cluding/excluding publications were defined: • Selected (yes or no)? Based on restrictions and quality
criteria.
• (Restriction R1) The study only includes papers avail-
• Comments/rationale regarding selection.
able in electronic form. Books were analyzed based on
• Needfortools.Doesthepublicationstresstheneedfor
information available online and using the hard copy
support (yes or no)?
versions.
• (Restriction R2) Only publications written in English
were included.
• (Quality criterion Q1) Each publication was checked 18
for completeness. Publications containing several un-
16 Selected
supported claims or frequently referring to existing
publications/
work without providing citations were excluded. 14 Year
• (Quality criterion Q2) Articles related to the topic of
12
this paper published between January 1, 2000, and
10
August 31, 2013, were included: (1) papers proposing
any method for SRE; (2) papers proposing knowledge 8
reuse-based methods for SRE; (3) papers proposing
6
automation of any (knowledge reuse-based) SRE.
• (Quality criterion Q3) Works of the same authors with 4
very similar content were included and grouped under 2
the same category (method).
0
• (Qualitycriterion Q4)Somearticleswere intentionally 0 1 2 3 4 5 6 7 8 9 0 1 2 3
0 0 0 0 0 0 0 0 0 0 1 1 1 1
excludedtokeeptheleveloftheSMAPmanageable,in 20 20 20 20 20 20 20 20 20 20 20 20 20 20
particular when the proposition was not relevant
Fig.2 Numberofselectedpublicationson(knowledge-based)secu-
enough to the topic of this paper. rityrequirementsengineering(2000–2013)
123
RequirementsEng
For each selected publication, the following additional • Philosophical:papersthatsketchanewwayoflooking
information was captured in a second form to increase at things, a new conceptual framework, etc.
confidence regarding their relevance for security require- • Evaluation research: papers that investigate a practice
mentsengineeringelicitationandanalysis:Themainfocus oranimplementation inpractice andreport the lessons
of the publication is on security requirements (yes) versus learned.
security requirements are only addressed as part of a • Validation research: papers that investigate the proper-
broader approach (no)? ties of a solution proposal that has not yet been
Searching the security requirements approaches and deployed in practice.
(re)usable knowledge-based security requirements ap- • Opinion papers: papers that contain the author’s
proaches conferences led to 158 papers, out of which 95 opinion about a research or practice subject.
(60 %) were related specifically to security requirements • Experience: papers that are often from industry prac-
approaches. Among these 95 papers, 29 papers (31 %) titioners or researchers who have used their tools in
addressed reuse of knowledge for security requirements. practice. They report how something was done in
Searching conferences led to the largest set of results: 39 practice.
papers (41 %) out of 70 papers found. Note that the se-
Some papers covered two categories. For example, a
lected conference papers were mainly found in two main
paper may be at the same time a ‘‘solution proposal’’ and
conferences proceedings: The International Conference on
‘‘validation research.’’ In such cases, we labeled them
Availability, Reliability and Security (ARES) with 13 pa-
‘‘solution proposal ? validation.’’ Conversely, some pa-
pers found out of which 8 were selected; the International
pers could not be linked to any category since they were
Conference on Requirements Engineering (RE) with 24
exclusively presenting tools. Thus, we decided to use the
conference papers found and 7 selected.
label ‘‘tool.’’
The number of selected journal papers was 20 (21 %)
Table 1 summarizes the results of the classification.
out of 31 papers found. The total number of workshop
Most of the papers are solution proposals (41 %), few of
papers found was 21, out of which 11 (12 %) were se-
which are validated (22.1 %). Evaluation researches that
lected. Fifteen out of 18 (16 %) relevant technical reports
investigated the practices in industry are only (10.5 %).
were also considered in our search. Books and book
Eight papers were exclusively presenting tools.
chapters were taken in consideration too: out of 18 re-
trieved sources, 10 (10 %) were selected.
4.2 A framework for analyzing and comparing
Table 4inthe‘‘Appendix’’givesallthedetailsaboutthe
knowledge reuse in SRE (data extraction
retrievedpublications,theirtypesandtheonesselected.Fig-
and mapping of studies)
ure 3summarizesthestatisticalresultsofallselectedpapers
bycategories(books,conferences,workshops,andreports).
Extracting the data, while surveying in depth the different
For the selected papers, we were also interested in the
approaches for SRE with regards to knowledge reuse, al-
type of the research. As recommended by Petersen et al.
lows us to define the different categories covered by the
[21], we adapted the classification system developed by
study and construct the map (i.e., a framework for
Wieringa et al. [25] for requirements engineering paper
analyzing and comparing knowledge reuse in SRE). The
classification. The papers were thereby classified into:
frameworkshowninFig. 4isstructuredaroundfacetsthat
• Solution proposal: papers that discuss new or revised capture individual dimensions related to knowledge reuse
techniques, in SRE. This framework makes it possible to organize the
different methods, techniques, and tools for knowledge
reuse in SRE around different axes that were identified
Selected papers
through the SMAP and appeared relevant to us.
4.2.1 Knowledge
The knowledge facet identifies the different knowledge
(re)usedinSRE.Thisfacetwasorganizedunderthreemain
sub-dimensions(byanalogytotheclassificationframework
proposed by Dubois et al. [26]):
• Organization & Assets: All the knowledge related to
the organization, its assets, its actors can be (re)used
Fig.3 Relative share of the various paper types in the selected set
(Books,Conferences,Workshops,andReports) over different projects.
123
RequirementsEng
n • Risk: Knowledge related to risk addresses different
o
ati threatsthatmightthreatentheassetsofanorganization,
d
ali thevulnerabilitiesthatmightbeexplored,theattackers,
v
? %) and their attack methods.
olution 0 1(22.1 • Rrisiskk, sturecahtmaesnst:eckunriotwylreedqgueireremlaetnetds,tcooumnitteirgmateinasgurtehse,
S 0 5 1 1 5 2 and security policies.
ol
o
?t 4.2.2 Form of representation
n
o
ati The ‘‘form of representation’’ facet indicates the different
d
ali types of knowledge forms that were identified and how
v
? they are organized: patterns, taxonomies and ontologies,
n %)
o templates and profiles, catalogs and generic models, and
oluti (5.2 mixed.
S 1 2 0 2 0 5
%) 4.2.3 Technique
4
ool (8. The technique facet defines whether the knowledge (re)use
T 2 0 5 0 1 8
techniquescanbeautomated(e.g.,queries),semi-automated
on %) (e.g.,process),oraretotallymanual(e.g.,guidelines).
pini (0
O 0 0 0 0 0 0
4.2.4 Automated support
e
enc %) The ‘‘automated support’’ facet checks the existence of an
peri 2.1 automated support for knowledge (re)use in SRE and its
x (
E 0 1 1 0 0 2 technology features.
The next section details the publications retrieved and
alidation (2.1%) rferapmlieeswotorkt.he research questions relying on the presented
V 0 0 0 2 0 2
4.3 Details of the systematic mapping study
n %)
o
aluati (10.5 rTeaubsleei2nSpRreEsemntesthaondso.vCeorvluiemwnsocfotnhteainsetchuerimtyaiknncoownlceedpgtes
v 0
E 1 2 4 1 2 1
characterizing the conceptual space of security. Lines
cover the different reuse forms by SRE methods. Cells
al
phic %) contain a colored area when there exist SRE publications
o proposing a reuse-based approach of a given reuse form,
ers hilos (8.4 for a given security concept. The colors of the cells get
p P 2 0 2 2 2 8
a darkeraccordingtothenumberofpublicationscoveringit.
p
d It is white when there is no publication describing such a
ecte osal link.
ofsel Prop %) This presentation should help the reader to understand
umber olution 0 5 9(41 tahlseosehceulrpistytoreuresatrbileeveknfoowrleeadcgheicnotnhceepbtodoyfosfecliuterirtaytu(ree..gI.t,
n S 5 1 1 4 5 3 security requirement) how (through ontologies, templates)
d
an and how much it is reused. As an illustration, the security
pe er) concept ‘‘threat’’ is covered by a lot of publications
Ty hapt nce op proposing to reuse it through ontologies or taxonomies.
Table1 Book(c Journal Confere Worksh Report Total preTsehnetafoblrloiewfidnegscpriaprtaigornaopfhsthegoSRiEntometthheodd,eftoalillosw. eTdhbeyy
123
RequirementsEng
Fig.4 Frameworkfor
knowledgereuseinSRE
Table2 SecurityknowledgereuseinSRE
Security Counter-
Organiza(cid:2)on Asset Threat Vulnerability Securitygoal
requirement measure

Ontologies/
taxonomies

Catalog/
genericmodels

Pa(cid:3)erns

Templates

Mixed
answers to the research questions (method, form of repre- (re)useformused.Thus,wedistinguish:methodsthatreuse
sentation, technique, and automation). The paragraphs re- patterns, taxonomies and ontologies, catalogs or generic
port the different types of reusable elements and how they models, and mixed forms of reuse. We also distinguish
are modeled and described, and how they are used. methods thatdonotreuseanykind ofsecurityknowledge.
In fact, there are different ways for presenting and
classifying SRE methods, depending on the angle from 4.3.1 Methods that (re)use security patterns
which we study and analyze them. For instance, Fabian
et al. [27] organize SRE methods into six main categories A security pattern describes a particular recurring security
(multilateral, UML-based, goal-oriented approaches, problemthatarisesinspecificcontextsandpresentsawell-
problem frames-based, risk analysis-based, common crite- proven generic scheme for its solution [29]. The SMAP
ria-based). Elahi [28] organizes SRE methods into two found that some SRE methods (re)use patterns during the
main categories depending on whether the method focuses SRE process in the form of models or in other forms.
onthethreatsandvulnerabilities(thedarksideofsecurity)
or on security requirements and countermeasures (the
4.3.1.1 Patterns of models The identified SRE that
white side of security).
(re)use patterns of models are presented below:
Asthemaingoalofthispaperistofocusonknowledge
(re)use in SRE, the different methods will be presented • KAOS and Anti-Models: Lamsweerde [5, 30] extended
using the result of RQ2, i.e., according to the knowledge the KAOS method to support security issues at the
123
RequirementsEng
requirements level. KAOS is a requirements engineer- They used the Alexandrian format [39] for organizing
ing method dealing with the elaboration of the objec- eachpattern.Inthisformat,thesectionsofapatternare
tives to be achieved by the system-to-be. (Knowledge context, problem and forces, solution, and rationale.
reliance) Hermoye et al. [11, 31] enriched the KAOS (Reusable knowledge) Authors proposed four main
framework with an attack pattern library and reusable patterns: ‘‘Agency Guard’’ concerned with ensuring
countermeasuresbuiltafteranalyzingcommonalitiesin thatthere is only asingle pointofaccesstotheagency
goal-oriented specifications from some case studies. to protect it from malicious agents. ‘‘Agent Authenti-
(Reusable Knowledge) In this approach, a reusable cator’’ related to authentication of agency’s agents.
attackpatterncapturescommonobjectivesofmalicious ‘‘Sandbox’’ related to mechanisms for separating run-
agentsforknownattacks(e.g.,replay,denialofservice, ningactivities.‘‘AccessController’’suggestsintercept-
and password attacks). Reusable countermeasures are ingallrequestsfortheagency’sresources.(Technique)
reusable anti-goal resolutions. For example, counter- Mouratidis et al. provide some guidelines and show
measures against replay attacks may include freshness how these patterns can be integrated within the
mechanisms.(Formofrepresentation)Hermoyeetal. architectural design stage of the Tropos agent-oriented
use a library of attack patterns; an attack pattern is a methodology. (Automation) ST-Tool is one of the
fragment of an anti-model defined on an abstract main tools known for secure tropos. Formal analysis is
domain. Attack patterns are built with abstract anti- based on logic programming. ST-Tool [40] provides a
goals and abstract domain properties. Abstract anti- graphical user interface (GUI) that allows designers
goals, domain properties, and predicates are reusable editingsecuretroposmodelsasgraphswherenodesare
concepts defined on abstract domains that should be actors and services, and arcs are relationships. To the
specialized in concrete domains at reuse time. (Tech- best of our knowledge, ST-Tool does not handle the
nique) Hermoye et al. provide a formal technique to development using patterns for elicitation.
reusethislibraryforthreatanalysis.Theyproposethree
main functions: Retrieve to get initial anti-goals, and
4.3.1.2 Patterns not models The identified SRE that
Specialize and Adapt to specialize each abstract vari-
(re)use patterns are presented below:
able (e.g., objects, agents, and relations) of the attack
pattern.(Automation)TheKAOSmethodissupported • Okubo et al. [41] propose a method for security
by the Objectiver1 tool. Even though we do not have impact and security requirements analyzes. There are
details about technical aspects, the tool offers some two types of security impact described with more
functionalities such as modeling requirements and details in the paper: horizontal impact on artifacts in
related concepts (goals, obstacles, expectations, hy- the same stage and vertical impact on artifacts in a
potheses, etc.), querying the model to retrieve some later stage. (Knowledge reliance) The method pro-
model elements, exporting in XML format, and data posed by Okubo et al. consists of two techniques: an
exchanges in XMI format. Note that the tool does not analysis method of horizontal impacts using an
handle the reuse of knowledge for SRE. extended misuse case; a combination of new security
• Secure Tropos: secure tropos method is derived from patterns and a traditional traceability technique to
Tropos. The latter is a software development method analyze security vertical impacts. The security patterns
based on the paradigm of agent-oriented software bridge the gap between security requirements and the
development [32, 33]. There are different extensions design, so as to know impacts on code when security
of Tropos in the literature. Mouratidis et al. [4, 34, 35] requirements change. (Form of representation)
extend Tropos with new concepts to cover security Okubo et al. constructed security requirements pat-
modeling (security constraints, secure dependencies, terns (SRPs) and security design patterns (SDPs). A
and secure entities) and more. secure tropos distin- security requirement pattern is formed around a
guishes four main development phases: early require- ‘‘context,’’ a ‘‘problem,’’ a ‘‘solution,’’ and a ‘‘struc-
ments, late requirements, architectural design, detailed ture.’’ In addition, a security design pattern has:
designandarchitecturaldesign.Recently,securetropos ‘‘consequences,’’ ‘‘implementation,’’ and ‘‘sample
wasextendedtobeusedinthefieldofcloudcomputing code.’’ (Reusable knowledge) In terms of knowledge,
[36–37]. (Knowledge reliance) In a previous work, SRPs provide assets and threats. SDPs provide coun-
Tropos method was extended with security patterns termeasures. (Technique) The authors propose a
[38]. (Form of representation) Authors describe a process for security impact analysis that starts with
pattern language, based on agent-oriented concepts. selecting the SRP, identifying new assets, identifying
new threats, identifying countermeasures, and finally,
1 http://www.objectiver.com/. selecting the SDP, and ends with estimating the
123
RequirementsEng
impact for each countermeasure. (Automation) The [2, 40, 46–48]. The authors use the secure i* (Si*)
method is not tool supported. language. In addition to the notions originally sup-
ported by the i* modeling framework, Si* introduces
the notions of delegation and trust. Delegation is de-
4.3.2 Methods that (re)use taxonomies or ontologies
fined as a relation between two actors (the delegator
and the delegatee—the one to whom something is
An ontology is a formal representation of the entities and
delegated)andagoal,task,orresource(thedelegatum).
relationships which exist in some domain. A taxonomy is
The notion of trust is used to separate delegation be-
anontologyintheformofahierarchy.Whereasontologies
tween trusted and untrusted actors. Similar to delega-
can have any type of relationship between categories, in a
tion, trust is defined as a relation between two actors
taxonomytherecanonlybegeneralizationhierarchies[42].
(thetrustorandthetrustee)andagoal,task,orresource
TheSMAPrevealedavarietyofSREmethodsthatsuggest
(thetrustum).AthirdextensiontoTroposwasproposed
theuse ofontologiesortaxonomiesduringaSREprocess:
by Asnar et al. [49, 50] for risk modeling, the tropos
• GBRAM, the goal-based requirements analysis method goal risk framework, to assess risk, based on trust re-
[43, 44] is a straightforward methodical approach to lations among actors. (Knowledge reliance) Massacci
identify system and enterprise goals and requirements. etal.[51]proposeaformalontologyforsocio-technical
(Knowledge reliance & Form of representation) systems.(Formofrepresentation)Authorsformalized
Anton et al. [45] propose a requirements taxonomy for the concepts of Si* into an ontology. (Reusable
reducing Web site privacy vulnerabilities. They knowledge) The concepts are organized into exten-
evaluated 25 Internet privacy policies from eight non- sional and intentional predicates. Extensional pre-
regulated e-commerce industries. The evaluation per- dicates correspond to the edges and circles drawn by
mitted us to identify main goals and vulnerabilities. therequirementsengineer(e.g., service, goal,task,and
(Reusable knowledge) The security knowledge in the resource) during the modeling phase. These predicates
taxonomy was categorized into Privacy Protection are used to formalize the intuitive description of the
Goals and Privacy Vulnerabilities. system. Intentional predicates are determined with the
help of rules by the reasoning system; examples of
• Privacy protection goals express the desired pro-
these predicates are: aim(Actor:x, Service:s)
tection of consumer privacy rights. They were
and has_perm(Actor:x, Service:s). (Tech-
categorized into five categories: notice/awareness,
nique)Theauthorsprovidesomeaxiomsthatdefinethe
choice/consent,access/participation,integrity/secu-
semantics underlying Si*. They are used to complete
rity, and enforcement/redress. For instance, notice/
the extensional description of the system. All these
awareness goals assert that consumers should be
primitives were used to deal with the security organi-
notified or made aware of an organization’s infor-
zational requirements.
mation practices before any information is actually
The proposition (Pro) in the example below verifies
collected from them. More details about the other
whether an actor (X) who delegates the permission
goalscanbefoundinAtonetal.’spublication[45].
(perm) to another actor (Y) to deliver a service (S) is
• PrivacyvulnerabilitiesreflectwaysinwhichaWeb
entitled to do it. With other predicates, one can verify
sitemay violate consumer privacy. Thesevenmain
the authorization security requirement.
categoriesofprivacyvulnerabilitiesare:information
For example, Authorization: Pro / delega-
monitoring, information aggregation, information
te(perm, X, Y, S) ^ not has_perm(X, S).
storage, information transfer, information collec-
(Automation) As far as we know, there was no au-
tion,information personalization, and contact.
tomation support for this secure tropos extension.
(Technique) The authors mentioned that Web site de- • RITA: Elena Ivankina et al. [52, 53] (Knowledge
signers can use this taxonomy to ensure that their stated reliance) present a requirements elicitation method
andactualpoliciesareconsistentwitheachotheranditcan called requirements identification threat analysis
be used by customers to evaluate and understand policies (RITA) that makes use of a threat ontology. (Form of
and their limitations. However, there were no precise representation) Security requirements in RITA are
proceduresortechniquesfor theuse. (Automation)As far expressed in forms of treatment that prevent threats.
as we could determine, the GBRAM method is not tool Treatmentsareformalizedasgoals.Agoalisdefinedas
supported. ‘‘something that some stakeholder hopes to achieve in
• Secure Tropos: Another extension of the Tropos the future’’ [54]. A goal is expressed as a clause with
methodology was the one proposed by Massacci et al. a main verb and several parameters, where each
123