Adapting Secure Tropos for Security Risk Management in the Early Phases of Information Systems Development

  • Authors:

  • Raimundas Matulevičius;Nicolas Mayer;Haralambos Mouratidis;Eric Dubois;Patrick Heymans;Nicolas Genon

  • Affiliations:

  • PReCISE, Computer Science Faculty, University of Namur, Belgium;PReCISE, Computer Science Faculty, University of Namur, Belgium and CRP Henri Tudor - CITI, Luxembourg;School of Computing and Technology, University of East London, UK;CRP Henri Tudor - CITI, Luxembourg;PReCISE, Computer Science Faculty, University of Namur, Belgium;PReCISE, Computer Science Faculty, University of Namur, Belgium

  • Venue:
  • CAiSE '08 Proceedings of the 20th international conference on Advanced Information Systems Engineering
  • Year:
  • 2008

Quantified Score

Hi-index 0.00

Visualization

Abstract

Security is a major target for today's information systems (IS) designers. Security modelling languages exist to reason on security in the early phases of IS development, when the most crucial design decisions are made. Reasoning on security involves analysing risk, and effectively communicating risk-related information. However, we think that current languages can be improved in this respect. In this paper, we discuss this issue for Secure Tropos, the language supporting the eponymous agent-based IS development. We analyse it and suggest improvements in the light of an existing reference model for IS security risk management. This allows for checking Secure Tropos concepts and terminology against those of current risk management standards, thereby improving the conceptual appropriateness of the language. The paper follows a running example, called eSAP, located in the healthcare domain.