SREP: A Proposal for Establishing Security Requirements for the Development of Secure Information Systems

Daniel Mellado, Eduardo Fernández-Medina, Mario Piattini

2006

Abstract

Nowadays, security solutions are mainly focused on providing security defences, instead of solving one of the main reasons for security problems that refers to an appropriate Information Systems (IS) design. In this paper a proposal for establishing security requirements for the development of secure IS is presented. Our approach is an asset-based and risk-driven method, which is based on the reuse of security requirements, by providing a security resources repository, together with the integration of the Common Criteria into traditional software lifecycle model, so that it conforms to ISO/IEC 15408. Starting from the concept of iterative software construction, we will propose a micro-process for the security requirements analysis, that is repeatedly performed at each level of abstraction throughout the incremental development. In brief, we will present an approach which deals with the security requirements at the first stages of software development in a systematic and intuitive way, and which conforms to ISO/IEC 17799:2005.

Paper Citation

in Harvard Style

Mellado D., Fernández-Medina E. and Piattini M. (2006). SREP: A Proposal for Establishing Security Requirements for the Development of Secure Information Systems . In Proceedings of the 4th International Workshop on Security in Information Systems - Volume 1: WOSIS, (ICEIS 2006) ISBN 978-972-8865-52-8, pages 135-145. DOI: 10.5220/0002482701350145

in Bibtex Style

@conference{wosis06,
author={Daniel Mellado and Eduardo Fernández-Medina and Mario Piattini},
title={SREP: A Proposal for Establishing Security Requirements for the Development of Secure Information Systems},
booktitle={Proceedings of the 4th International Workshop on Security in Information Systems - Volume 1: WOSIS, (ICEIS 2006)},
year={2006},
pages={135-145},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0002482701350145},
isbn={978-972-8865-52-8},
}

in EndNote Style

TY - CONF
JO - Proceedings of the 4th International Workshop on Security in Information Systems - Volume 1: WOSIS, (ICEIS 2006)
TI - SREP: A Proposal for Establishing Security Requirements for the Development of Secure Information Systems
SN - 978-972-8865-52-8
AU - Mellado D.
AU - Fernández-Medina E.
AU - Piattini M.
PY - 2006
SP - 135
EP - 145
DO - 10.5220/0002482701350145