Skip to main content
SpringerLink
Log in

Towards an Approach for Security Risk Analysis in COTS Based Development

  • Conference paper
Software Process Change (SPW 2006)

Part of the book series: Lecture Notes in Computer Science ((LNPSE,volume 3966))

Included in the following conference series:

Abstract

More and more companies tend to use secure products as COTS to develop their secure systems due to resource limitations. The security concerns add more complexity as well as potential risks to COTS selection process, and it is always a great challenge for developers to make the selection decisions. In this paper, we provide a method for security risk analysis in COTS based development (CBD) based on Common Criteria and our previous work in identifying general risk items for CBD. The research result provides useful insights for developers in identifying security risks, so that it can be used to aid for the COTS selection decision.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. Devanbu, P., Stubblebine, S.: Software Engineering for Security: a Roadmap. In: The Future of Software Engineering. Special volume of the proceedings of the 22nd International Conference on Software Engieering – ICSE 2000 (June 2000)

    Google Scholar 

  2. Kontio, J.: A Case Study in Applying a Systematic Method for COTS Selection. In: Proceedings of the 18th international conference on Software engineering, Berlin, Germany (May 1996)

    Google Scholar 

  3. Brownsword, L., Oberndorf, T., Sledge, C.: Developing New Processes for COTS-Based Systems. IEEE Software (July/August 2000)

    Google Scholar 

  4. Lindqvist, U., Jonsson, E.: A Map of Security Risks Associated with Using COTS. In Computer 31(6), 60–66 (1998)

    Article  Google Scholar 

  5. Common Criteria for Evaluation Criteria for IT Security V2.1. ISO/IEC 15408, National Institute of Standards and Technology (1999)

    Google Scholar 

  6. Yang, Y., Boehm, B., Wu, D.: COCOTS Risk Analyzer. In: ICCBSS 2006, Orlando, USA (February 2006) (accepted)

    Google Scholar 

  7. http://niap.nist.gov/cc-scheme/vpl/vpl_type.html

  8. Colbert, E., Wu, D., Chen, Y., Boehm, B.: “Costing Secure Systems”. In: 18th International Forum on COCOMO and Software Cost Modeling, Los Angeles (October 2003)

    Google Scholar 

Download references

Author information

Authors and Affiliations

  1. Center for Software Engineering, University of Southern California, 941 W. 37th Place, SAL Room 328, Los Angeles, CA, 90089-0781, USA

    Dan Wu & Ye Yang

Authors
  1. Dan Wu
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Ye Yang
    View author publications

    You can also search for this author in PubMed Google Scholar

Editor information

Editors and Affiliations

  1. Massey University, New Zealand

    Qing Wang

  2. Department of Informatics, University of Oslo, Norway

    Dietmar Pfahl

  3. Portland State University, 631 SW Harrison St., Portland, OR, USA

    David M. Raffo

  4. School of Computer Science, University of Hertfordshire, College Lane, AL10 9AB, Hatfield, Herts, UK

    Paul Wernick

Rights and permissions

Reprints and permissions

Copyright information

© 2006 Springer-Verlag Berlin Heidelberg

About this paper

Cite this paper

Wu, D., Yang, Y. (2006). Towards an Approach for Security Risk Analysis in COTS Based Development. In: Wang, Q., Pfahl, D., Raffo, D.M., Wernick, P. (eds) Software Process Change. SPW 2006. Lecture Notes in Computer Science, vol 3966. Springer, Berlin, Heidelberg. https://doi.org/10.1007/11754305_14

Download citation

  • DOI: https://doi.org/10.1007/11754305_14

  • Publisher Name: Springer, Berlin, Heidelberg

  • Print ISBN: 978-3-540-34199-4

  • Online ISBN: 978-3-540-34201-4

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation