An Ontology for Secure Socio-Technical Systems
IGI Global eBooksPublished 1 January 2008
Fabio Massacci, John Mylopoulos, Nicola Zannone
Citations41
Generate an AI Snapshot to get a quick, structured summary of this paper.
Study Snapshot
ObjectiveStudy objective
MethodsResearch methodology
PopulationPopulation studied
Sample sizeSample sizes
OutcomesStudy outcomes here
ResultsStudy results comes here
LimitationsResearch study limitations comes here
A concise AI-generated summary of the paper will appear here once you click Generate AI Snapshot.
TL;DR
This chapter presents a modeling language tailored to analyze the problem of security at an organizational level, and proposes a set of concepts founded on the notions of permission, delegation, and trust based on Datalog.
Abstract
Security is often compromised by exploiting vulnerabilities in the interface between the organization and the information systems that support it. This reveals the necessity of modeling and analyzing information systems together with the organizational setting where they will operate. In this chapter we address this problem by presenting a modeling language tailored to analyze the problem of security at an organizational level. This language proposes a set of concepts founded on the notions of permission, delegation, and trust. The chapter also presents a semantics for these concepts, based on Datalog. A case study from the bank domain is employed to illustrate the proposed language.
Keywords
Computer ScienceSocial Sciences
Academy of Management ReviewAn Integrative Model Of Organizational Trust
14,126 Citations1995Roger C. Mayer, James H. Davis +1 more
Academy of Management ReviewNot So Different After All: A Cross-Discipline View Of Trust
9,911 Citations1998Denise M. Rousseau, Sim B. Sitkin +2 more
ComputerRole-based access control models
5,757 Citations1996Ravi Sandhu, Edward J. Coyne +2 more
Why RBAC is receiving renewed attention as a method of security administration and review is explained, a framework of four reference models developed to better understandRBAC is described, and the use of RBAC to manage itself is discussed.
Lecture notes in computer scienceOn Non-Functional Requirements in Software Engineering
2,240 Citations2009Lawrence Chung, Julio César Sampaio do Prado Leite
This chapter reviews the state of the art on the treatment of non-functional requirements (hereafter, NFRs), while providing some prospects for future directions.
Science of Computer ProgrammingGoal-directed requirements acquisition
1,971 Citations1993Anne Dardenne, Axel van Lamsweerde +1 more
An approach to requirements acquisition is presented which is driven by higher-level concepts that are currently not supported by existing formal specification languages, such as goals to be achieved, agents to be assigned, alternatives to be negotiated, etc.
Autonomous Agents and Multi-Agent SystemsTropos: An Agent-Oriented Software Development Methodology
1,737 Citations2004Paolo Bresciani, Anna Perini +3 more
The goal in this paper is to introduce and motivate a methodology, called Tropos, for building agent oriented software systems, based on the notion of agent and all related mentalistic notions, formalized in a metamodel described with a set of UML class diagrams.
Review of Financial StudiesConflict of Interest and the Credibility of Underwriter Analyst Recommendations
1,639 Citations1999Roni Michaely, Kent L. Womack
Modelling strategic relationships for process reengineering
1,404 Citations1995John Mylopoulos, Eric Yu
ACM Transactions on Computational LogicThe DLV system for knowledge representation and reasoning
1,171 Citations2006Nicola Leone, Gerald Pfeifer +5 more
The experimental results confirm the solidity of DLV and highlight its potential for emerging application areas like knowledge management and information integration, and the main international projects investigating the potential of the system for industrial exploitation are described.
The Knowledge Engineering ReviewThe Enterprise Ontology
912 Citations1998Mike Uschold, M. King +2 more
The Enterprise Ontology was developed within the Enterprise Project, a collaborative effort to provide a framework for enterprise modelling, and was built to serve as a basis for this framework which includes methods and a computer tool set for enterprise modeling.
Requirements EngineeringEliciting security requirements with misuse cases
722 Citations2004Guttorm Sindre, Andreas L. Opdahl
This paper presents a systematic approach to eliciting security requirements based on use cases, with emphasis on description and method guidelines, and is potentially useful for several other types of extra-functional requirements beyond security.
Communications of the ACMThe platform for privacy preferences
711 Citations1999Joseph Reagle, Lorrie Faith Cranor
It is believed users' confidence in online transactions will increase when they are presented with meaningful information and choices about Web site privacy practices, and P3P is not a silver bullet; it is complemented by other technologies as well as regulatory and self-regulatory approaches to privacy.
THE MEANINGS OF TRUST
563 Citations2000D. Harrison McKnight, Norman L. Chervany +1 more
Medical Entomology and ZoologyThe platform for privacy preferences 1.0 (p3p1.0) specification
514 Citations2002Lorrie Faith Cranor, Marc Langheinrich +2 more
Principles of trust for MAS: cognitive anatomy, social importance, and quantification
485 Citations2002Cristiano Castelfranchi, Rino Falcone
A principled quantification of trust is presented, based on its cognitive ingredients, to use this "degree of trust" as the basis for a rational decision to delegate or not to another agent.
ACM Transactions on Software Engineering and MethodologyModel driven security
478 Citations2006David Basin, Jürgen Doser +1 more
This work presents several instances of this schema that combine (both syntactically and semantically) different UML modeling languages with a security modeling language for formalizing access control requirements, and generates access control infrastructures for server-based applications built from declarative and programmatic access control mechanisms.
ACM Transactions on Information and System SecurityDelegation logic
427 Citations2003Ninghui Li, Benjamin N. Grosof +1 more
D1LP provides a concept of proof-of-compliance that is founded on well-understood principles of logic programming and knowledge representation, and provides a logical framework for studying delegation.
Using abuse case models for security requirements analysis
398 Citations2003John McDermott, Chris Fox
A proven object oriented modeling technique is adapted, use cases, to capture and analyze security requirements in a simple way, and its relationship to other security engineering work products is relatively simple, from a user perspective.
Journal of Lightwave TechnologySecurity and privacy requirements analysis within a social setting
393 Citations2004L. Liu, Eric Yu +1 more
A methodological framework for dealing with security and privacy requirements based on i*, an agent-oriented requirements modeling language is proposed, which supports a set of analysis techniques and helps identify potential system abusers and their malicious intents.
Communications of the ACMWhy cryptosystems fail
346 Citations1994Ross Anderson
It turns out that the threat model commonly used by cryptosystem designers was wrong: most frauds were not caused by cryptanalysis or other technical attacks, but by implementation errors and management failures, suggesting that a paradigm shift is overdue in computer security.
Social roles and their descriptions
325 Citations2004Claudio Masolo, Laure Vieu +5 more
This paper establishes a general formal framework for developing a foundational ontology of socially constructed entities, in the broadest sense of this notion, and further contributes to understanding the ontological nature of roles.
Lecture notes in computer scienceA Model for the Structural, Functional, and Deontic Specification of Organizations in Multiagent Systems
177 Citations2002Jomi Fred Hübner, Jaime Simão Sichman +1 more
The MOISE+ model - described here through a soccer team example - intends to be a step in this direction since the organization is seen under three points of view: structural, functional, and deontic.
Computer Integrated Manufacturing SystemsA framework to define a generic enterprise reference architecture and methodology
159 Citations1996Péter Bernus, L. Nemes
GERAM is meant to unify existing architectures rather than intending to replace them, achieved by ensuring that the scope of GERAM spans all areas of consideration in an enterprise.
International Journal of Information SecurityRequirements engineering for trust management: model, methodology, and reasoning
111 Citations2006Paolo Giorgini, Fabio Massacci +2 more
A set of concepts founded on the notions of ownership, permission, and trust and intended for requirements modeling are proposed and shown to support the automatic verification of security and trust requirements using Datalog.
Computer Standards & InterfacesUsing a security requirements engineering methodology in practice: The compliance with the Italian data protection legislation
88 Citations2005Fabio Massacci, Marco Prest +1 more
A comprehensive case study of the application of the Secure Tropos RE methodology for compliance to the Italian legislation on Privacy and Data Protection by the University of Trento, leading to the definition and analysis of a ISO-17799-like security management scheme.
Control principles and role hierarchies
81 Citations1998Jonathan Moffett
The relationship between the inheritance properties of role hierarchies and control principles which are used in many large organisations: separation of duties; delegation; and supervision and review is examined.
Lecture notes in computer scienceSecurity and Trust Requirements Engineering
70 Citations2005Paolo Giorgini, Fabio Massacci +1 more
This paper critically review the state of the art in security requirements engineering and discusses the motivations that led to the Secure Tropos methodology, a formal framework for modelling and analyzing security, that enhances the agent-oriented software development methodology i*/Tropos.
Information Management & Computer SecurityEmbedding security practices in contemporary information systems development approaches
55 Citations2001Theo Tryfonas, Evangelos Kiountouzis +1 more
This paper addresses the lack of a defined discipline for security concerns integration in systems development by using field study results recording development practices that are currently in use to illustrate their deficiencies, to point to required enhancements of practice and to propose a list of desired features that contemporary development practices should incorporate to address security concerns.
Information systems as social structures
50 Citations2001Ariel Fuxman, Paolo Giorgini +2 more
An ontology for information systems that is inspired by social and organizationalstructures is proposed that adopts components of the i*organizational modeling framework, which is founded on the notions of actor, goal and social dependency.
How responsibility modelling leads to security requirements
34 Citations1993Ros Strens, John F. Dobson
This paper proposes that the concept of responsibility fills both the needs of identifying and specifying organisational requirements, including those related to security, that arise when a technical system is placed in a social context.
Munich Personal RePEc Archive (Ludwig Maximilian University of Munich)Detecting conflicts between functional and security requirements with Secure Tropos: John Rusnak and the Allied Irish Bank (Chapter 9)
24 Citations2011Fabio Massacci, Nicola Zannone