Using requirements engineering in an automatic security policy derivation process - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2012

Using requirements engineering in an automatic security policy derivation process

Résumé

Traditionally, a security policy is defined from an informal set of requirements, generally written using natural language. It is then difficult to appreciate the compatibility degree of the manually generated security policy with the informal requirements definition. The idea of this paper is to automate the process of deriving the formal security policy, using a more structured specification of the security objectives issued by the administrator of the information system to be secured. We chose the goal-oriented methodology KAOS to express the functional objectives, then based on the results of a risk analysis, we integrate the security objectives to the obtained KAOS framework. Finally, through a process of transformation applied to this structured security objectives specification, we automatically generate the corresponding security policy. This policy is consistent with the access control model OrBAC (Organization Access Control).
Fichier non déposé

Dates et versions

hal-00738844 , version 1 (05-10-2012)

Identifiants

Citer

Mariem Graa, Nora Cuppens-Boulahia, Fabien Autrel, Hanieh Azkia, Frédéric Cuppens, et al.. Using requirements engineering in an automatic security policy derivation process. DPM - SETOP 2011 : 6th International Workshop on Data Privacy Management and 4th International Workshop on Autonomous and Spontaneous Security, Sep 2011, Leuven, Belgium. pp.155-172, ⟨10.1007/978-3-642-28879-1_11⟩. ⟨hal-00738844⟩
110 Consultations
0 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More