ACM Transactions on Information and System Security (TISSEC)
Software Engineering Economics
Software Engineering Economics
A Methodology for Architecture-Level Reliability Risk Analysis
IEEE Transactions on Software Engineering
An Empirically-Based Process for Software Architecture Evaluation
Empirical Software Engineering
ICSE '76 Proceedings of the 2nd international conference on Software engineering
A Survey of Software Refactoring
IEEE Transactions on Software Engineering
The Security Development Lifecycle
The Security Development Lifecycle
Privtrans: automatically partitioning programs for privilege separation
SSYM'04 Proceedings of the 13th conference on USENIX Security Symposium - Volume 13
Some thoughts on security after ten years of qmail 1.0
Proceedings of the 2007 ACM workshop on Computer security architecture
Rubacon: automated support for model-based compliance engineering
Proceedings of the 30th international conference on Software engineering
A Call to Action: Look Beyond the Horizon
IEEE Security and Privacy
Tool-supported development with Tropos: the conference management system case study
AOSE'07 Proceedings of the 8th international conference on Agent-oriented software engineering VIII
Secure Systems Development with UML
Secure Systems Development with UML
The 5th international workshop on software engineering for secure systems (SESS'09)
ICSE '09 COMPANION Proceedings of the 2009 31st International Conference on Software Engineering: Companion Volume
Measuring the interplay of security principles in software architectures
ESEM '09 Proceedings of the 2009 3rd International Symposium on Empirical Software Engineering and Measurement
Automated detection of least privilege violations in software architectures
ECSA'10 Proceedings of the 4th European conference on Software architecture
Composition of least privilege analysis results in software architectures (position paper)
Proceedings of the 7th International Workshop on Software Engineering for Secure Systems
Enforcing access control in workflow systems with a task engineering approach
International Journal of Internet Technology and Secured Transactions
| Hi-index | 0.00 |
Supporting a security principle, such as least privilege, in a software architecture is difficult. Systematic rules are lacking, no guidance explains how to apply the principle in practice. As a result, security principles are often neglected. This lowers the overall security level of the software system and the cost of fixing such problems later on in the development cycle is high. We propose an improvement in supporting least privilege in software architectures. We have identified architectural transformations that reduce violations to the principle of least privilege. These transformations have been implemented. We have applied the solution on a case study.