TY - GEN
T1 - Using requirements engineering in an automatic security policy derivation process
AU - Graa, Mariem
AU - Cuppens-Boulahia, Nora
AU - Autrel, Fabien
AU - Azkia, Hanieh
AU - Cuppens, Frédéric
AU - Coatrieux, Gouenou
AU - Cavalli, Ana
AU - Mammar, Amel
PY - 2012/1/1
Y1 - 2012/1/1
N2 - Traditionally, a security policy is defined from an informal set of requirements, generally written using natural language. It is then difficult to appreciate the compatibility degree of the manually generated security policy with the informal requirements definition. The idea of this paper is to automate the process of deriving the formal security policy, using a more structured specification of the security objectives issued by the administrator of the information system to be secured. We chose the goal-oriented methodology KAOS to express the functional objectives, then based on the results of a risk analysis, we integrate the security objectives to the obtained KAOS framework. Finally, through a process of transformation applied to this structured security objectives specification, we automatically generate the corresponding security policy. This policy is consistent with the access control model OrBAC (Organization Access Control).
AB - Traditionally, a security policy is defined from an informal set of requirements, generally written using natural language. It is then difficult to appreciate the compatibility degree of the manually generated security policy with the informal requirements definition. The idea of this paper is to automate the process of deriving the formal security policy, using a more structured specification of the security objectives issued by the administrator of the information system to be secured. We chose the goal-oriented methodology KAOS to express the functional objectives, then based on the results of a risk analysis, we integrate the security objectives to the obtained KAOS framework. Finally, through a process of transformation applied to this structured security objectives specification, we automatically generate the corresponding security policy. This policy is consistent with the access control model OrBAC (Organization Access Control).
KW - KAOS
KW - OrBAC
KW - Requirement engineering
KW - Security policy
UR - https://www.scopus.com/pages/publications/84903853389
U2 - 10.1007/978-3-642-28879-1_11
DO - 10.1007/978-3-642-28879-1_11
M3 - Conference contribution
AN - SCOPUS:84903853389
SN - 9783642288784
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 155
EP - 172
BT - Data Privacy Management and Autonomous Spontaneous Security - 6th International Workshop, DPM 2011, and 4th International Workshop, SETOP 2011, Revised Selected Papers
PB - Springer Verlag
T2 - 6th International Workshop on Data Privacy Management, DPM 2011 and 4th SETOP International Workshop on Autonomous and Spontaneous Security, SETOP 2011
Y2 - 15 September 2011 through 16 September 2011
ER -