Software Security Engineering – Part II-Reference-Cited by-同舟云学术

Software Security Engineering – Part II

Published:2013 Issue: Volume: Page:256-284
ISSN:
Container-title:Software Development Techniques for Constructive Information Systems Design
language:
Short-container-title:

Author:

Traore Issa¹,Woungang Isaac²

Affiliation:

1. University of Victoria, Canada

2. Ryerson University, Canada

Abstract

This chapter explains the major objectives of a security policy, with focus on how applications that can protect data at all access points can be developed. Access control models and their known issues are discussed. From a security policy prospective, the security design principles and modeling using the UML are also discussed. In addition, an informal discussion on potential software security metrics that can be used for security measurement, and that are currently the purpose of active research, is conducted. Finally, a discussion on security testing involving the use of these metrics, are discussed. Several examples are used to illustrate the studied concepts.

Publisher

IGI Global

Reference50 articles.

1. Abrams, M. D., Heaney, J. E., King, O., LaPadula, L. J., Lazear, M. B., & Olson, I. M. (1991). Generalized framework for access control: Towards prototyping the ORGCON Policy. Proceedings of the 14th National Computer Security Conference, Baltimore, MD, USA.

2. ACSI - Australian Communications – Electronic Security Instruction 33. (2012). The Information Security Group of the Australian Government’s Defense Signals Directorate. Retrieved March 18, 2012, from www.dsd.gov.au/_lib/pdf_doc/acsi33/acsi33_u_0904.pdf

3. Alexander, I. (2003). Misuse cases: Use cases with hostile intent. IEEE Computer Society, Focus Magazine.

4. Alger, J. I. (2001). On assurance, measures, and metrics: Definitions and approaches. Workshop on Information-Security-System Rating and Ranking, Williamsburg, Virginia, May 21-23.

5. The ISDF framework: Integrating security patterns and best practice.;A.Alkussayer;Journal of Information Processing Systems,2009