Abstract
The paper makes two main contributions: (1) It presents experiences from using the CORAS language for security threat modelling to specify legal risk scenarios. These experiences are summarised in the form of requirements to a more expressive language providing specific support for the legal domain. (2) Its second main contribution is to present ideas towards the fulfilment of these requirements. More specifically, it extends the CORAS conceptual model for security risk analysis with legal concepts and associations. Moreover, based on this extended conceptual model, it introduces a number of promising language constructs addressing some of the identified deficiencies.
This is a preview of subscription content, log in via an institution to check access.
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
Jøsang, A., Ismail, R., Boyd, C.: A Survey of Trust and Reputation Systems for Online Service Provision. Decision Support Systems (to appear), http://security.dstc.edu.au/papers/JIB2005-DSS.pdf
Egger, F.N.: Towards a model of trust for e-commerce system design. In: CHI 2000: Workshop Designing Interactive Systems for 1-to-1 E-commerce (2000), http://www.zurich.ibm.com/~mrs/chi2000/contributions/egger.html
Jones, S., Wilikens, M., Morris, P., Masera, M.: Trust requirements in e-business. Communications of the ACM 43, 81–87 (2000)
Wahlgren, P.: Juridisk riskanalys - Mot en säkrare juridisk metod. Jure, Stockholm (2003) (in Swedish)
Susskind, R.: The Future of Law. Clarendon Press, Oxford (1996)
Reidenberg, J.: Lex Informatica: The Formulation of Information Policy Rules Through Technology. In: Texas Law Review, vol. 76, pp. 553–593 (1998)
CORAS: The CORAS project (2005), http://coras.sourceforge.net/ (visited February 2005)
Dimitrakos, T., Ritchie, B., Raptis, D., Aagedal, J.Ø., den Braber, F., Stølen, K., Houmb, S.H.: Integrating model-based security risk managament into eBusiness systems development: The CORAS approach. In: I3E 2002, pp. 159–175. Kluwer, Dordrecht (2002)
Raptis, D., Dimitrakos, T., Gran, B.A., Stølen, K.: The CORAS approach for model-based risk management applied to e-commerce domain. In: CMS 2002, pp. 169–181. Kluwer, Dordrecht (2002)
OMG: UML 2.0 Superstructure Specification (2004) OMG Document: ptc/2004-10-02
Lund, M.S., Hogganvik, I., Seehusen, F., Stølen, K.: UML profile for security assessment. Technical Report STF40 A03066, SINTEF Telecom and informatics (2003)
OMG: UML Profile for Modeling Quality of Service and Fault Tolerance Characteristics and Mechanisms, Draft Adopted Specification (2004), OMG Document: ptc/2004-06-01
TrustCoM: Trust and Contract Management in Virtual Organisations (2005), http://www.eu-trustcom.com/ (visited February 2005)
Redmill, F., Chudleigh, M., Catmur, J.: HazOp and software HazOp. Wiley, Chichester (1999)
Chellas, B.F.: Modal Logic - An Introduction. Cambridge University Press, Cambridge (1980)
Elgesem, D.: The Modal Logic of Agency. Nordic Journal of Philosophical Logic 2 (1997)
Brændeland, G., Stølen, K.: Using risk analysis to assess user trust - a net-bank scenario. In: Jensen, C., Poslad, S., Dimitrakos, T. (eds.) iTrust 2004. LNCS, vol. 2995, pp. 146–160. Springer, Heidelberg (2004)
den Braber, F., Lund, M.S., Stølen, K.: Using the CORAS Threat Modelling Language to Document Threat Scenarios for several Microsoft relevant Technologies. Technical Report STF90 A04057, SINTEF ICT (2004)
Berardi, D., Calì, A., Calvanese, D., De Giacomo, G.: Reasoning on UML Class Diagrams. Technical Report 11-03, Dipartimento di Informatica e Sistemistica, Università di Roma La Sapienza (2003)
Haugen, Ø., Husa, K.E., Runde, R.K., Stølen, K.: Why timed sequence diagrams require three-event semantics. In: Leue, S., Systä, T.J. (eds.) Scenarios: Models, Transformations and Tools. LNCS, vol. 3466, pp. 1–25. Springer, Heidelberg (2005)
ISO/IEC: FCD 15414: Information Technology - Open Distributed Processing - Reference Model - Enterprise Viewpoint. JTC1/SC7 N2359, ISO/IEC (2000)
Damianou, N., Dulay, N., Lupu, E., Sloman, M.: The Ponder Specification Language. In: Sloman, M., Lobo, J., Lupu, E.C. (eds.) POLICY 2001. LNCS, vol. 1995, p. 18. Springer, Heidelberg (2001)
OASIS: eXtensible Access Control Markup Language (XACML) Version 1.0. Technical report, OASIS (2003)
Chu, Y.H., Feigenbaum, J., LaMacchia, B., Resnick, P., Strauss, M.: Referee: Trust management for web applications. In: Sixth International World Wide Web Conference, Santa Clara, CA, USA (1997)
Blaze, M., Feigenbaum, J., Ioannidis, J., Keromytis, A.D.: The KeyNote Trust Management System, Version 2. Request For Comments (RFC) 2704, AT&T Labs and University of Pennsylvania (1999)
Biskup, J., Karabulut, Y.: A Hybrid PKI Model with an Application for Secure Mediation. In: 16th Annual IFIP WG 11.3 Working Conference on Data and Application Security, Cambridge, England, pp. 271–282. Kluwer Academic Press, Dordrecht (2002)
PERMIS: Privilege and Role Management Infrastructure Standards Validation (2004), http://sec.isi.salford.ac.uk/permis/ (visited December 2004)
Bresciani, P., Giorgini, P., Giunchiglia, F., Mylopoulos, J., Perini, A.: TROPOS: An Agent-Oriented Software Development Methodology. Journal of Autonomous Agents and Multi-Agent Systems 8, 203–236 (2004)
Sagri, M.T., Tiscornia, D., Gangemi, A.: An ontology-based model for Representing Bundle-of-rights. In: Meersman, R., Tari, Z., Corsaro, A. (eds.) OTM-WS 2004. LNCS, vol. 3292, pp. 674–688. Springer, Heidelberg (2004)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2005 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Vraalsen, F., Lund, M.S., Mahler, T., Parent, X., Stølen, K. (2005). Specifying Legal Risk Scenarios Using the CORAS Threat Modelling Language. In: Herrmann, P., Issarny, V., Shiu, S. (eds) Trust Management. iTrust 2005. Lecture Notes in Computer Science, vol 3477. Springer, Berlin, Heidelberg. https://doi.org/10.1007/11429760_4
Download citation
DOI: https://doi.org/10.1007/11429760_4
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-26042-4
Online ISBN: 978-3-540-32040-1
eBook Packages: Computer ScienceComputer Science (R0)