Abstract
Information systems (IS) security within organizations is more and more focused around risk management approaches. Central to these approaches is the need for a better understanding of the required alignment between the business view of the organization and the architecture of its underlying IS. Through the use of requirements engineering techniques, the paper suggests how this business/IT interoperability issue is tackled together with the clarification of the underlying security risk management ontology.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
8 References
J.D. Moffett, C.B. Haley, and B. Nuseibeh, “Core Security Requirements Artefacts”, Technical Report Number 2004/23, Department of Computing, Open University, UK, 2004.
Direction Centrale de la Sécurité des Systèmes d’Information (DCSSI) (2004, February), Expression des Besoins et Identification des Objectifs de Sécurité (EBIOS), from http://www.ssi.gouv.fr/fr/confiance/ebios.html
ISO/IEC 17799:2005, Information Technology — Security techniques-Code of Practice for Information Security Management, Geneva, 2005.
Common Criteria for Information Technology Security Evaluation, Version 2.2 (2004), ISO 15408, from http://www.commoncriteriaportal.org
L. Lin, B. Nuseibeh, D. Ince, and M. Jackson, “Using Abuse Frames to Bound the Scope of Security Problems”, Proceedings of the 12th IEEE International Requirements Engineering Conference, IEEE Computer Society Press, Kyoto, Japan, 2004.
A. van Lamsweerde, and E. Letier, “Handling Obstacles in Goal-Oriented Requirements Engineering”, IEEE Transactions on Software Engineering, Special Issue on Exception Handling, Vol. 26 No. 10, October 2000.
L. Liu, E. Yu and J. Mylopoulos, “Security and Privacy Requirements Analysis within a Social Setting”, International Conference on Requirements Engineering (RE’03), Monterey, California, September 2003.
P. Gaunard, and E. Dubois, “Using Requirements Engineering Techniques for Bridging the Gap Between Risk Analysis and Security Policies”, 18th IFIP International Information Security Conference, Athens, Greece, May 2003.
L. Chung, B.A. Nixon, E. Yu, J. Mylopoulos, Non-Functional Requirements in Software Engineering, Kluwer Academic Publishers, Boston, 2000.
E. Dubois, N. Mayer, A. Rifaut, and V. Rosener, “Contributions méthodologiques pour l’amélioration de l’analyse des risques”, Les enjeux de la sécurité multimédia Vol.1 (traité IC2, série informatique et SI), Hermes, 2005. ISBN: 2-7462-1207-2
D.P. Gilliam, and M.S. Feather, “Security Engineering: Systems Engineering of Security through the Adaptation and Application of Risk Management”, INCOSE 2004-14th Annual International Symposium Proceedings, Toulouse, France, Jun 20–24 2004.
N. Mayer, A. Rifaut, and E. Dubois, “Towards a Risk-Based Security Requirements Engineering Framework”, 11th International Workshop on Requirements Engineering: Foundation for Software Quality (REFSQ’05), in conjunction with CAiSE’05, Porto, Portugal, June 2005.
A. Osterwalder, and Y. Pigneur, “An ontology for e-business models”, Value Creation from E-Business Models, W. Currie, Butterworth-Heinemann, 2004.
M. Schmitt, B. Grégoire, S. Ramel, C. Incoul, P. Brimont, and E. Dubois. “If business models could speak! Efficient: a framework for appraisal, design and simulation of electronic business transactions”, International Conference on Enterprise Integration and Modelling Technology (ICEIMT’04), Toronto, October 2004.
J. Gordijn, V. Kartseva, J. Schildwacht, R.J. Wieringa and J.M. Akkermans, “Developing a Domain-Specific Cross-Organizational RE Method”, Proceedings of the 12th IEEE International Requirements Engineering Conference, M. Aoyama, Motoshi Saeki, Neil Maiden (eds), IEEE CS, Kyoto, Japan, 2004.
M. Lankhorst. et al., Enterprise Architecture at Work — Modelling, Communication and Analysis, Springer-Verlag, 2005. ISBN: 3-540-24371-2
B. van der Raadt, J. Gordijn, and E. Yu, “Exploring Web Services Ideas from a Business Value Perspective”, Proceedings of the 2005 13th IEEE International Conference on Requirements Engineering (RE’05), Joanne Atlee and Colette Roland (eds.), pp 53–62, IEEE CS, 2005.
M. Saeki, “Embedding Metrics into Information Systems Development Methods: An Application of Method Engineering Technique”, Proceedings of CAiSE’03 Conf., Springer Verlag, 2003, pp.374–389.
H. Mouratidis, P. Giorgini, G. Manson, “Integrating Security and Systems Engineering: Towards the Modelling of Secure Information Systems”, Proceedings of the 15th Conference on Advance Information Systems (CAiSE’ 03), 16–20 June, Velden, Austria.
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2007 Springer-Verlag London Limited
About this paper
Cite this paper
Mayer, N., Dubois, E., Rifaut, A. (2007). Requirements Engineering for Improving Business/IT Alignment in Security Risk Management Methods. In: Gonçalves, R.J., Müller, J.P., Mertins, K., Zelm, M. (eds) Enterprise Interoperability II. Springer, London. https://doi.org/10.1007/978-1-84628-858-6_2
Download citation
DOI: https://doi.org/10.1007/978-1-84628-858-6_2
Publisher Name: Springer, London
Print ISBN: 978-1-84628-857-9
Online ISBN: 978-1-84628-858-6
eBook Packages: EngineeringEngineering (R0)