Model-based security analysis in seven steps --- a guided tour to the CORAS method
BT Technology Journal
A semantic paradigm for component-based specification integrating a notion of security risk
FAST'06 Proceedings of the 4th international conference on Formal aspects in security and trust
Modular analysis and modelling of risk scenarios with dependencies
Journal of Systems and Software
A graphical approach to risk identification, motivated by empirical investigations
MoDELS'06 Proceedings of the 9th international conference on Model Driven Engineering Languages and Systems
Using dependent CORAS diagrams to analyse mutual dependency
CRITIS'07 Proceedings of the Second international conference on Critical Information Infrastructures Security
| Hi-index | 0.00 |
Methods for security risk analysis are often based on structured brainstorming (e.g. what calls HazOp). A structured brainstorming gathers a group of different system experts and the idea is that they will find more risks as a team than one-by-one. The CORAS modelling language has been designed to support the brainstorming process and to document security risk scenarios identified during these sessions. The language is graphical, based upon the Unified Modelling Language (UML), and is recommended by OMG. This paper reports the results from two empirical experiments concerning the CORAS language. Our results show (1) many security risk analysis terms are used in the daily language and therefore well understood, but the more abstract or less frequently used terms can be a possible source for misunderstandings in a security analysis, and (2) the language's graphical icons make diagram "navigation" faster, but the diagrams are not necessarily understood more correctly than those without graphical icons.