Search

Abstract Requirements engineering is a fundamental process in software development phases. At the same time, it is a difficult phase and exposed many ethical violations. The main purpose is proposing an ethical framework for software requirements engineering that addresses the identified concerns. These concerns include problems associated with a knowledge gap, requirements identification, quality‐related concerns, unwillingness to give requirements, and practicing forbidden activities. These concerns are grouped into a category as the proposed framework components. Each of the categories encompasses more than one problem domain. The proposed framework suggests resolving mechanisms as collections of clauses for each of those concerns. An expert evaluation technique is used to validate the proposed framework. The experts are purposefully selected from software industries and institutions. Questionnaires and focus group discussions were used as data‐gathering tools for the validation of the proposed framework. The validity (face validity, content validity, and construct validity) and the reliability of the proposed framework were checked. The evaluation results show that the proposed framework has an acceptable range of validity and reliability. The proposed framework can be used as a guideline for software engineers to minimise the occurrence of those identified concerns during the requirements engineering process.

Requirements engineering is a fundamental process in software development phases. At the same time, it is a difficult phase and exposed many ethical violations. The main purpose is proposing an ethical framework for software requirements engineering that addresses the identified concerns. These concerns include problems associated with a knowledge gap, requirements identification, quality‐related concerns, unwillingness to give requirements, and practicing forbidden activities. These concerns are grouped into a category as the proposed framework components. Each of the categories encompasses more than one problem domain. The proposed framework suggests resolving mechanisms as collections of clauses for each of those concerns. An expert evaluation technique is used to validate the proposed framework. The experts are purposefully selected from software industries and institutions. Questionnaires and focus group discussions were used as data‐gathering tools for the validation of the proposed framework. The validity (face validity, content validity, and construct validity) and the reliability of the proposed framework were checked. The evaluation results show that the proposed framework has an acceptable range of validity and reliability. The proposed framework can be used as a guideline for software engineers to minimise the occurrence of those identified concerns during the requirements engineering process. [ABSTRACT FROM AUTHOR]

The article presents the discussion on ownership of scientific data, databases, and processing software within the intellectual property law framework. Topics include substantial body of intellectual property and neighbouring laws developed for addressing the tension between the public interest in access to information and the private interests; and regarding the future of private ownership of software and data and the ability for controling access.

Software Quality Control (SQC) techniques are widely used throughout the software development process with the objective of assessing and detecting anomalies that affect the quality of an information system. Privacy is one quality attribute of software systems for which several SQC techniques have been proposed in recent years. However, research has been carried out from different perspectives and, consequently, it has led to a growing body of knowledge scattered across different domains. To bridge this gap, we have carried out a systematic mapping study to provide practitioners and researchers with an overview of the state-of-the-art techniques to carry out software quality control of information systems focusing on aspects of privacy. Our results show a steady growth in the research efforts in this field. The European General Data Protection Regulation seems to have a significant influence on this growth, since 37% of techniques that focus on assessing compliance derive their assessment criteria from this legal framework. The maturity of the techniques varies between the type of technique: Formal verification techniques exhibit the lowest level of maturity while the combination of techniques has demonstrated its successful application in real-world scenarios. The latter seems a promising avenue of research as it provides better results in terms of coverage, precision and effectiveness than the application of individual, isolated techniques. In this paper, we describe the existing SQC techniques focusing on privacy and provide a suitable basis for identifying future research directions.

The built environment is entering a period of great evolution, enabled by the adoption of building information modeling (BIM), the increased use of technologies in digital asset management, and the emergence of smart assets and the Internet of Things (IoT). This article considers the impact of these developments on security and privacy, and outlines the rationale for adopting a broader approach to cybersecurity than the confidentiality, integrity, and availability triad that's used by the information assurance community. It considers the impact of using new, predominantly wireless technologies in the built environment and discusses the need for security and privacy improvements. [ABSTRACT FROM AUTHOR]

Cloud is taking over the computing environment in both public as well as private sector. This has increased the use of service-oriented architecture (SOA) for the development of services later deployed in the Cloud. This paper presents a Cloud Security algorithm using SO A 3.0 for secured transactions on the data, which usually governments of countries like USA International Traffic in Arms Regulations (ITAR) and Export Administration Regulations (EAR) requires to be utilized and distributed only within United States by security cleared personal only. In this paper, we describe a novel algorithm and corresponding cloud service as Cloud Monitoring Gateway (CMG). The current service prototype simulates the behavior of actual Cloud Security Gateway Application (CSGA) using the algorithm called as TPALM (The Privacy Authentication Latency Management). This simulation is coarse-grained, but is capable of measuring the privacy authentication on the given variables of a legit user. We also present an evaluation of this service utilization on actual data. [ABSTRACT FROM AUTHOR]

In contemporary software development there are a number of methods that attempt to ensure the security of a system. Many of these methods are however introduced in the latter stages of development or try to address the issues of securing a software system by envisioning possible threats to that system, knowledge that is usually both subjective and esoteric. In this paper we introduce the concept of path fixation and discuss how contradictory paths or loopholes, discovered during requirements engineering and using only a requirements specification document, can lead to potential security flaws in a proposed system. The SECREt is a proof-of-concept prototype tool developed to demonstrate the effectiveness of loophole analysis. We discuss how the tool performs a loophole analysis and present the results of tests conducted on an actual specification document. We conclude that loophole analysis is an effective, objective method for the discovery of potential vulnerabilitites that exist in proposed systems and that the SECREt can be successfully incorporated into the requirements engineering process. [ABSTRACT FROM AUTHOR]

Abstract: Organizations using personal data in areas such as in Health Information Systems have, in recent years, shown an increasing interest in the correct protection of these data. It is not only important to define security measures for these sensitive data, but also to define strategies to audit their fulfilment. Although standardisation organisations have defined recommendations and standards related to security and audit controls, no methodological frameworks proposing the audit of these sensitive data have been described. This paper presents a methodology with which to audit personal data protection, using Requirements Engineering and based on CobiT. This methodology has been validated in four real case studies. [Copyright &y& Elsevier]

Abstract: One of the most important aspects in the achievement of secure software systems in the software development process is what is known as Security Requirements Engineering. However, very few reviews focus on this theme in a systematic, thorough and unbiased manner, that is, none of them perform a systematic review of security requirements engineering, and there is not, therefore, a sufficiently good context in which to operate. In this paper we carry out a systematic review of the existing literature concerning security requirements engineering in order to summarize the evidence regarding this issue and to provide a framework/background in which to appropriately position new research activities. [Copyright &y& Elsevier]

The article argues that as systems and organizations become deperimeterized, software engineers could no longer rely on an ethics of consequences but would need a new paradigm in software engineering ethics. It encourages engineers to instead rely on the precautionary principle, which lets them focus on creating a more extensive moral framework. The article further argues that the precautionary principle should be applied to software design so that potentially harmful uses are discouraged and beneficial uses are encouraged. The approach was developed to help cope with problems that arise where there is no longer any digital fence surrounding organizations to protect their security.

The article presents three cases to illustrate that the digital world phenomenon which improves accessibility of services and communal communication could also raise several ethical issues relating to privacy, monitoring and data protection and could also have the potential to cause harm. It discusses a legislation in Great Britain that pose three key challenges for software engineers designing systems for the digital world. The notion of ethics-aware software engineering is also advocated in the article, where ethical considerations are taken into account across the software development cycle.

This paper presents a new approach to representing and detecting computer penetrations in real-time. The approach, called state transition analysis, models penetrations as a series of state changes that lead from an initial secure state to a target compromised state. State transition diagrams, the graphical representation of penetrations, identify precisely the requirements for and the compromise of a penetration and present only the critical events that must occur for the successful completion of the penetration. State transition diagrams are written to correspond to the states of an actual computer system, and these diagrams form the basis of a rule-based expert system for detecting penetrations, called the state transition analysis tool (STAT). The design and implementation of a UNIX-specific prototype of this expert system, called USTAT, is also presented. This prototype provides a further illustration of the overall design and functionality of this intrusion detection approach. Lastly, STAT is compared to the functionality of comparable intrusion detection tools. [ABSTRACT FROM AUTHOR]

Moving toward high confidence software that can meet ever increasing demands for critical DOD applications will require planning, specifying, selecting, and managing the necessary development and testing activities that will ensure the success of the software project. In order to trust the decisions being made, there must he evidence (i.e., an information base of data and facts) that techniques and tools being chosen for application on critical projects will perform as expected. Today, these expectations are mostly intuitive; there is little hard evidence available to guide acquisition managers and software developers in making necessary decisions. This paper brings into perspective how software measurements can affect the confidence and trust that the DOD can place in its software. The paper describes a management approach to achieving high confidence software, highlighting software reliability as a key factor in that confidence. The concepts are presented from a DOD perspective but are applicable to any organization interested in managing software reliability. A software reliability measurement methodology is described for 1) specifying software reliability goals and the processes needed to help achieve those goals, 2) predicting and tracking progress during development (leading to corrective action to improve the software), 3) estimating reliability based on testing effort and processes, and 4) assessing achieved software reliability during operational use. The concept for a workable set of software reliability measures is presented to support this methodology. Typical questions that face the DOD are posed, and it is shown how the methodology, once implemented, can help answer those questions. [ABSTRACT FROM AUTHOR]

A database management system can ensure the semantic integrity of a database via an integrity control subsystem. A technique for implementation of such a subsystem is proposed. After a database is updated by transactions, its integrity must be verified by evaluation of a set of semantic integrity assertions. For evaluation of an integrity assertion a number of database pages need to be transferred from the secondary storage to the fast memory. Since certain pages may be required for evaluation of different integrity assertions, the order of the evaluation of the integrity assertions determines the total number of pages fetched from the secondary storage. Hence, the schedule for the evaluation determines the cost of the database verification process. We show that the search for an optimal schedule is an NP-hard problem. Four approximation algorithms that find suboptimal schedules are pro- posed. They are based on the utilization of intersections among sets of pages required for the evaluation of different integrity assertions. The theoretical worst case behaviors of these algorithms are studied. Finally, the algorithms are compared via a simulation study to a naive, random order verification approach. The methods proposed for minimizing the costs (if the batch integrity verification also apply to other problems that can be abstracted to the directed traveling salesman optimization problem. For example, the methods are applicable to multiple-query optimization and to concurrency control via the predicate locks. [ABSTRACT FROM AUTHOR]

Recently, the number of switching system functions has expanded substantially. Most of these functions are highly software dependent and this dependence is expected to increase in the future. Therefore, improvement of software productivity is critical in the switching field. In the software engineering field as a whole, it has been pointed out that problems in software development are caused by the current sequential processors and the procedural languages which reflect the processor architecture. This paper proposes a diagrammatic software design method based on a data-driven mechanism. Using this method, it is possible to realize complete data integration and to describe parallel operation. We call it ‘data-driven logic.’ This paper describes the general concepts of the diagrammatic language, which allows hierarchical design, the ‘components’ selection technique used as the instruction set for switching software and the results of an application in a real system. [ABSTRACT FROM AUTHOR]

Data and software are nowadays one and the same: for this very reason, the European Union (EU) and other governments introduce frameworks for data protection — a key example being the General Data Protection Regulation (GDPR). However, GDPR compliance is not straightforward: its text is not written by software or information engineers but rather, by lawyers and policy-makers. As a design aid to information engineers aiming for GDPR compliance, as well as an aid to software users' understanding of the regulation, this article offers a systematic synthesis and discussion of it, distilled by the mathematical analysis method known as Formal Concept Analysis (FCA). By its principles, GDPR is synthesised as a concept lattice , that is, a formal summary of the regulation, featuring 144372 records — its uses are manifold. For example, the lattice captures so-called attribute implications , the implicit logical relations across the regulation, and their intensity. These results can be used as drivers during systems and services (re-)design, development, operation, or information systems' refactoring towards more GDPR consistency. • Application of formal concept analysis to GDPR. • Rigorous elicitation for design principles and knowledge from the regulation. • Dataset for further reuse & ontology extraction. • Levels of complexity and foci for business process modelling and mining. [ABSTRACT FROM AUTHOR]

A new single-key-lock (SKL) mechanism used for implementing the access matrix of the computer protection system is proposed. The key selection is very flexible. The lock values are generated recursively based on the Newton's interpolating polynomial. The insertion of a new user/file into the system can be successfully implemented without recomputing all locks/keys. [ABSTRACT FROM AUTHOR]

Databases may be compromised by asking a set of queries which return only statistical information and making inferences about a specific entry from the results of the set of queries. We present methods of constructing the set of queries to compromise a database where all the queries in the set return the maximum of a set of k elements, or all queries return the mean of a set of k elements. In the case of the mean query, all elements involved will be compromised. We also consider bounds on the number of queries required to compromise the database. [ABSTRACT FROM AUTHOR]

The Urban Observatory (UO) at Newcastle represents a multi-million-pound investment in ubiquitous urban sensing, providing one of the largest real-time environmental datasets in the world. This research facility, majority staffed by research software engineers, provides open data used by community groups, local and national government, and research projects ranging from cyber-security to flood forecasting. Requirements and demands have developed over the last three years, and as new data sources were incorporated, RSEs were introduced with expertise in machine learning, high-performance computing, and hybrid database architecture. The UO's journey has not been plain sailing. Early efforts were plagued by communication problems and inconsistent clocks, rapid growth and attempts to maintain flexibility resulted in severe performance degradation, and progression into providing statistics about crowd density and people movements has introduced cyber-security and data protection challenges. This mixture of skills has broadened the remit of the RSEs involved, emphasised the need to communicate the lessons learned by means other than traditional academic publishing, and created opportunities for staff development in the form of new skills and supervision. The UO benefited from simultaneous improvements made by RSEs across the university; staff in similar roles were beginning to meet and discuss software engineering in their own research contexts, the need for formal recognition of their roles, and career progression. This began as links between software engineers within computing and engineering but has grown to incorporate diverse backgrounds from across the university. From initial interactions, these have become a series of meetups where staff in different disciplines can come together to discuss best practices when developing software for research. Progress is being made gaining recognition for the RSE role within the university, and the visibility of RSEs in the UO is benefiting the cause.Today, the UO receives and archives more than one hundred metrics per second, in addition to still images, video, radar and laser-scan matrices. Machine learning methods are applied in real-time across CCTV streams, and significant changes are identified using edge processing to reduce network loading. The introduction of data queues, progressively more sophisticated data sharding, thirty edge processors, and hourly replication has drastically reduced the frequency of problems. This would not have been possible without recognition for RSEs and their skills, and leveraging knowledge from the whole university. Incorporating robust software engineering principles into the UO played a key role in allowing it to grow from a research project in a single school to one of the university's flagship research facilities, and a world-leading exemplar for running city-scale experiments on IoT networks. Designing systems that scale, are reliable, and well-maintained is the central aim of an RSE. Examples such as this will help both in Newcastle and in the wider national community for a long term aim of getting RSEs recognised as a career path within academic institutions. The UO in Newcastle is the first of six observatories in the UK, and as these other observatories begin provisioning their networks, we hope it will facilitate RSE collaboration nationally and internationally. [ABSTRACT FROM AUTHOR]

The article provides information on the IEEE International Symposium on Secure Software Engineering to be held on March 13-15, 2006, in McLean, Virginia. The symposium series focuses on research and experience demonstrating the engineering community's response to the need for more secure software and addresses the interests of commercial, governmental, educational, and research sectors. The symposium addresses all aspects of the processes, techniques, technology, people, and knowledge base that have or need the capability to contribute to producing secure software.