Search

Electronic consent (e-consent) has the potential to solve many paper-based consent approaches. Existing approaches, however, face challenges regarding privacy and security. This literature review aims to provide an overview of privacy and security challenges and requirements proposed by papers discussing e-consent implementations, as well as the manner in which state-of-the-art solutions address them. We conducted a systematic literature search using ACM Digital Library, IEEE Xplore, and PubMed Central. We included papers providing comprehensive discussions of one or more technical aspects of e-consent systems. Thirty-one papers met our inclusion criteria. Two distinct topics were identified, the first being discussions of e-consent representations and the second being implementations of e-consent in data sharing systems. The main challenge for e-consent representations is gathering the requirements for a “valid” consent. For the implementation papers, many provided some requirements but none provided a comprehensive overview. Blockchain is identified as a solution to transparency and trust issues in traditional client-server systems, but several challenges hinder it from being applied in practice. E-consent has the potential to grant data subjects control over their data. However, there is no agreed-upon set of security and privacy requirements that must be addressed by an e-consent platform. Therefore, security- and privacy-by-design techniques should be an essential part of the development lifecycle for such a platform. ispartof: ACM Transactions on Computing for Healthcare vol:2 issue:2 pages:1-24 status: Published online

Threat modeling involves the systematic identification and analysis of security threats in the context of a specific system. This paper starts from an assessment of its current state of practice, based on interactions with threat modeling professionals. We argue that threat modeling is still at a low level of maturity and identify the main criteria for successful adoption in practice. Furthermore, we identify a set of key research challenges for aligning threat modeling research to industry practice, thereby raising the technology-readiness levels of the ensuing solutions, approaches, and tools. ispartof: pages:9-12 ispartof: International Conference on Software Engineering - New Ideas and Emerging Results (ICSE-NIER'20) pages:9-12 ispartof: International Conference on Software Engineering location:Seoul, South Korea date:23 May - 29 May 2020 status: Published online

Traditional threat modeling approaches such as Microsoft's STRIDE rely on Data Flow Diagrams (DFDs) as the main input. As DFDs are constructed from only five distinct model element types, these system models are deliberately kept simple. While this lowers the bar for practical adoption, there are a number of significant drawbacks. In this position paper, we identify and illustrate four key shortcomings of DFD models when used for security threat modeling, related to the inadequate representation of security concepts, data elements, abstraction levels, and deployment information. Based on these shortcomings, we posit the need for a dedicated, integrated language for threat modeling, and discuss the trade-offs that need to be made between the ease of adoption and the level of support for systematic and repeatable threat modeling.

Security patterns are intended to package reusable security solutions and have received considerable research attention in the two decades since their introduction. Practitioners seem less intent to use these security patterns while designing software, though, despite the prevalence of reuse in secure software engineering. We believe this is primarily because current security patterns do not tackle the security problems practitioners actually face. In this vision paper, we conceive a new way for expressing security patterns, built on a set of reusable and well-known security building blocks. We also advocate the inclusion of these building blocks as first-class citizens in a security-specific modelling language. This not only facilitates unambiguous communication of security solutions such as patterns, but also allows designers to construct a security view of their design which in turn opens new avenues for a broader security by design methodology. ispartof: pages:45-48 ispartof: SEAD’18:IEEE/ACM 1st International Workshop on Security Awareness from Design to Deployment pages:45-48 ispartof: First International Workshop on Security Awareness from Design to Deployment location:Gothenburg, Sweden date:27 May - 3 Jun 2018 status: published

The development of secure and privacy-preserving software systems entails the continuous consideration of the security and privacy aspects of the system under development. While contemporary software development practices do support such a continuous approach towards software development, existing threat modeling activities are commonly executed as single-shot efforts leading to a single, historic, and quickly obsolete view on the security and privacy of the system. This disconnect leads to undetected new issues and wasted efforts on already resolved problems, effectively accruing technical debt. The presented SPARTA prototype facilitates the consideration of security and privacy by providing support for: (i) capturing security and privacy design decisions in a DFD-based architectural abstraction, (ii) continuous threat elicitation on this knowledge-enriched abstraction, and (iii) risk analysis of the elicited threats for prioritizing security and privacy efforts. By capturing and continuously assessing the impact of security and privacy design decisions on the elicited threats, the progress towards securing the system can be assessed and alternatives can be compared, taking into account past and present design decisions. ispartof: pages:96-99 ispartof: 2018 IEEE International Conference on Software Architecture Companion (ICSA-C) pages:96-99 ispartof: International Conference on Software Architecture location:Seattle, United States date:30 Apr - 4 May 2018 status: Published online

In the past 10 years, the research community has produced a significant number of design notations to represent security properties and concepts in a design artifact. These notations are aimed at documenting and analyzing security in a software design model. The fragmentation of the research space, however, has resulted in a complex tangle of different techniques. Hence, practitioners are confronted with the challenging task of scouting the right approach from a multitude of proposals. Similarly, it is hard for researchers to keep track of the synergies among the existing notations, in order to identify the existing opportunities for original contributions. This paper presents a systematic literature review that inventorizes the existing notations and provides an in-depth, comparative analysis for each. ispartof: Software and Systems Modeling vol:16 issue:3 pages:809-831 status: published

Creating secure and privacy-protecting systems entails the simultaneous coordination of development activities along three different yet mutually influencing dimensions: translating (security and privacy) goals to design choices, analyzing the design for threats, and performing a risk analysis of these threats in light of the goals. These activities are often executed in isolation, and such a disconnect impedes the prioritization of elicited threats, assessment which threats are sufficiently mitigated, and decision-making in terms of which risks can be accepted. In the proposed TMaRA approach, we facilitate the simultaneous consideration of these dimensions by integrating support for threat modeling, risk analysis, and design decisions. Key risk assessment inputs are systematically modeled and threat modeling efforts are fed back into the risk management process. This enables prioritizing threats based on their estimated risk, thereby providing decision support in the mitigation, acceptance, or transferral of risk for the system under design. ispartof: pages:290-291 ispartof: ICSE '18 Proceedings of the 40th International Conference on Software Engineering: Companion Proceedings pages:290-291 ispartof: International Conference on Software Engineering location:Gothenburg, Sweden date:27 May - 3 Jun 2018 status: Published online

Threat modelling refers to a number of systematic approaches for eliciting security and/or privacy threats. Data Flow Diagrams (DFDs) are the main input for threat modelling techniques such as Microsoft STRIDE or LINDDUN. They represent system-level abstractions that lack any architectural knowledge on existing security solutions. However, this is not how software is built in practice: there are often previously-made security- and privacy-relevant decisions that originate from the technological context or domain, reuse, or external dependencies. Not taking these into account leads to the enumeration of many non-applicable threats during threat modelling. While recording the effect of these decisions on individual elements can provide some relief, the lack of a proper first-class representation causes conflicts when modifying the architecture and inhibits traceability between effect and decision. In this paper, we enrich Data Flow Diagrams with security solution elements, which are taken into account during threat elicitation. Our modelling approach is supported by a proof-of-concept implementation of a threat modelling framework and validated in the context of a STRIDE analysis of an industrial video conferencing solution that is based onWebRTC. The presented DFD enrichments are a key enabler for future efforts towards dynamic and continuous threat modeling. ispartof: pages:1425-1432 ispartof: Proceedings of ACM SAC Conference pages:1425-1432 ispartof: SAC 2018: Software Architecture: Theory, Technology, and Applications (SA-TTA) location:Pau, France date:9 Apr - 13 Apr 2018 status: Published online

Threat modeling involves the systematic identification, elicitation, and analysis of privacy- and/or security-related threats in the context of a specific system. These modeling practices are performed at a specific level of architectural abstraction – the use of Data Flow Diagram (DFD) models, for example, is common in this context. To identify and elicit threats, two fundamentally different approaches can be taken: (1) elicitation on a per-element basis involves iteratively singling out individual architectural elements and considering the applicable threats, (2) elicitation at the level of system interactions (which involve the local context of three elements: a source, a data flow, and a destination) performs elicitation at the basis of system-level communication. Although not considering the local context of the element under investigation makes the former approach easier to adopt and use for human analysts, this approach also leads to threat duplication and redundancy, relies more extensively on implicit analyst expertise, and requires more manual effort. In this paper, we provide a detailed analysis of these issues with element-based threat elicitation in the context of LINDDUN, an element-driven privacy-by-design threat modeling methodology. Subsequently, we present a LINDDUN extension that implements interaction-based privacy threat elicitation and we provide in-depth argumentation on how this approach leads to better process guidance and more concrete interpretation of privacy threat types, ultimately requiring less effort and expertise. A third standalone contribution of this work is a catalog of realistic and illustrative LINDDUN privacy threats, which in turn facilitates practical threat elicitation using LINDDUN. ispartof: pages:79-86 ispartof: 2018 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) pages:79-86 ispartof: International Workshop on Privacy Engineering 2018 location:London date:27 Apr - 27 Apr 2018 status: Published online

Implementing security by design in practice often involves the application of threat modeling techniques to elicit security threats and to aid designers in focusing their security efforts on the most stringent problems first. Existing threat modeling methodologies are capable of generating lots of threats, yet they lack even basic support to triage these threats, except for relying on the expertise and manual assessment by the threat modeler. Since the essence of creating a secure design is to minimize associated risk (taking into account the cost of countermeasures), risk analysis approaches offer a very compelling solution to this problem. By combining risk analysis and threat modeling, elicited threats in a design can be enriched with risk analysis information in order to provide support in triaging and prioritizing threats and focusing security efforts on the high-risk threats. It requires the following inputs: the asset values, the strengths of countermeasures (taking vulnerabilities into account as well), and an attacker model. In his paper, we provide an integrated threat elicitation and risk analysis approach, implemented in a threat modeling tool prototype, and evaluate it using a real-world application, namely the SecureDrop whistleblower submission system. We show that the security measures implemented in SecureDrop indeed correspond to the high-risk threats identified by our approach. Therefore, the risk-based security analysis provides useful guidance on focusing security efforts on the most important problems first. ispartof: pages:11-18 ispartof: SEAD '18 Proceedings of the 1st International Workshop on Security Awareness from Design to Deployment pages:11-18 ispartof: Security Awareness from Design to Deployment (SEAD) location:Gothenburg, Sweden date:27 May - 27 May 2018 status: Published online

Designing a secure software system requires the ability to represent and reason about a wide variety of security concerns. Existing modelling representations lack a comprehensive set of security building blocks or lack support for composition or refinement of the design under consideration. We propose a new modular meta-model for representing these security designs. This model supports both composition for more complex solutions and representing different levels of abstraction to model the underlying details. This meta-model can subsequently be used for the construction of security solutions, supporting a wide range of mechanisms on a wide variety of abstraction levels, thereby providing a foundation for the security-by-design approach. ispartof: pages:16-16 ispartof: Programming '17: Companion to the First International Conference on the Art, Science and Engineering of Programming vol:Part F129681 pages:16-16 ispartof: Modularity in Modelling (MoMo) location:Brussels, Belgium date:3 Apr - 3 Apr 2017 status: published

With the increasingly pervasive role of software in society, security is becoming an important quality concern, emphasizing security by design, but it requires intensive specialization. Security in families of systems is even harder, as diverse variants of security solutions must be considered, with even different security goals per product. Furthermore, security is not a static object but a moving target, adding variability. For this, an approach to systematically address security concerns in software product lines is needed. It should consider security separate from other variability dimensions. The main challenges to realize this are: (i) expressing security and its variability, (ii) selecting the right solution, (iii) properly instantiating a solution, and (iv) verifying and validating it. In this paper, we present our research agenda towards addressing the aforementioned challenges. ispartof: pages:342-343 ispartof: Proceedings of the 20th International Systems and Software Product Line Conference Pages vol:20 pages:342-343 ispartof: International Systems and Software Product Line Conference - Doctoral Symposium location:Beijing, China date:16 Sep - 23 Sep 2016 status: published