Mutual refinement of security requirements and architecture using twin peaks model

Takao Okubo*, Haruhiko Kaiya, Nobukazu Yoshioka

*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceedingConference contribution

4 Citations (Scopus)

Abstract

It is difficult to sufficiently specify software security requirements because they depend on a software architecture that has not yet been designed. Although the Twin Peaks model is a reference model to elicit a sufficient amount of software requirements in conjunction with the architectural requirements, it is still unclear how the security requirements can be elicited while taking the architecture into consideration. We propose a novel method to elicit the security requirements with architecture elaboration based on the Twin Peaks model, which is called the Twin Peaks Model application for Security Analysis (TMP-SA). In our method, security countermeasures for attacks are elicited as the security requirements incrementally according to the refinement of the architecture. We can comprehensively explore the alternatives for the countermeasures (security requirements) and choose the most suitable one for each project because we can focus on the architecture-specific security issues as well as architecture-independent security issues. We have applied our method to several applications and discuss its advantages and limitations. We found that our method is suitable for iterative development, and it enables us to find threats caused by architectural issues that are severely difficult to find when analyzing only the requirements issues.

Original languageEnglish
Title of host publicationProceedings - 36th Annual IEEE International Computer Software and Applications Conference Workshops, COMPSACW 2012
Pages367-372
Number of pages6
DOIs
Publication statusPublished - 2012
Externally publishedYes
Event36th Annual IEEE International Computer Software and Applications Conference Workshops, COMPSACW 2012 - Izmir, Turkey
Duration: 2012 Jul 162012 Jul 20

Publication series

NameProceedings - International Computer Software and Applications Conference
ISSN (Print)0730-3157

Conference

Conference36th Annual IEEE International Computer Software and Applications Conference Workshops, COMPSACW 2012
Country/TerritoryTurkey
CityIzmir
Period12/7/1612/7/20

Keywords

  • Application security
  • Software requirements engineering
  • Twin peaks model

ASJC Scopus subject areas

  • Software
  • Computer Science Applications

Fingerprint

Dive into the research topics of 'Mutual refinement of security requirements and architecture using twin peaks model'. Together they form a unique fingerprint.

Cite this