![](bgb.png)
Our goal is to develop a tool-supported process appropriate for industrial use.
Positive results from pilot projects in an industrial context encourage us to move
further to this direction. Currently, the process model is extended and elaborated by
our groups in many directions, ranging from the formal modelling of access policies,
the tool-supported management of requirements, threats and risks to the platform-
independent development of security solutions to component framework (J2EE /
.NET) related security issues.
References
[1] I. Jacobson, G. Booch, J. Rumbaugh: The Unified Software Development Process. Addison-
Wesley, 1999.
[2] P. Kruchten: The Rational Unified Process. Addison-Wesley, 1999.
[3] D. D´Souza, A. Wills: Components and Frameworks with UML – The Catalysis Approach.
Addison-Wesley, 1999.
[4] R. Breu, K. Burger, M. Hafner, G. Popp, J. Jürjens, G. Wimmel: Security-Critical System
Development with Extended Use Cases. Accepted for APSEC03.
[5] D. Basin, J. Doser, T. Lodderstedt: Model Driven Security for Process-Oriented Systems.
In 8th ACM Symposium on Access Control Models and Technologies. ACM Press, 2003.
[6] D. Firesmith: Security Use Cases. In: Journal of Object Technology 2(3), 2003.
http://www.jot.fm/issues/issue_2003_05/column6
[7] T. Lodderstedt, D. Basin, J. Doser: Secureuml: A uml-based modeling language for model-
driven security. In: J.-M. Jézéquel, H. Hussmann, S. Cook (eds.): UML 2002. Lecture Notes in
Computer Science, vol. 2460, Springer, 2002.
[8] www.v-modell.iabg.de
[9] R. Breu, K. Burger, M.Hafner, G. Popp: Core Concepts of a Process Model for Security
Engineering. Accepted for Icssea 2003.
[10] G. Popp: Vorgehensmodelle für die Entwicklung sicherer Systeme. Dissertation, Munich
University of Technology, to appear.
[11] R. Breu, G. Popp: Actor-Centric Modeling of Access Rights. Submitted for publication.
[12] J. Yoder, J. Barcalow: Architectural Patterns for Enabling Application Security . 4
th
Conference of Pattern Languages of Programs (PloP), 1997.
[13] E. Fernandez, R. Pan: A Pattern Language for Security Models. 8
th
Conference of Pattern
Languages of Programs (PloP), 2001.
[14] B. Blakley: Securtiy Design Patterns. The OpenGroup. 2002.
http://www.opengroup.org/security/gsp.htm
[15] M. Schumacher: Security Engineering with Patterns. PhD Thesis, Lecture Notes in
Computer Science, LNCS 2754, Springer, 2003.
[16] M. Kis: Information Security Antipatterns in Software requirements Engineering. 9
th
Conference of Pattern Languages of Programs (PloP), 2002.
[17] J.D. Meier et al.:, Improving Web Application Security, Threats and Countermeasures.
Microsoft Corporation, 2003.
[18] Bundesamt für Sicherheit in der Informationstechnologie: IT Baseline Protection Manual.
Bonn, 2001. http://www.bsi.de/gshb/english/menue.htm
[19] T. R. Peltier: Information Security Risk Analysis. Auerbach, 2001.
[20] http://java.sun.com/j2ee/
[21] R. Anderson: Security Engineering. John Wiley, 2001.
[22] J. Jürjens: Secure Systems Development with UML. Springer, to appear.
11