Towards Agile Security Risk Management in RE and Beyond

Virginia N.L. Franqueira; Zornitza Bakalova; Thein Tan Tun; Maya Daneva

doi:10.1109/EmpiRE.2011.6046253

Towards Agile Security Risk Management in RE and Beyond

Virginia N.L. Franqueira, Zornitza Bakalova, Thein Tan Tun, Maya Daneva

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

6 Citations (Scopus)

561 Downloads (Pure)

Abstract

Little attention has been given so far to the process of security risk management at the early stages of system development. Security has been addressed by isolated security assurance practices, some of which consider risks and mitigations but they do not provide an overview of the overall security state of the system being developed. This paper takes the position that (1) these isolated security assurance practices should be fully integrated and should be embedded in short iterations of risk assessment, treatment and acceptance, providing input for updating security requirements and for security risk management, and that (2) available empirical data from public catalogs and databases should be used as a source of expertise, to leverage past experiences, and therefore reduce, although not eliminate, subjectivity of human judgment. Borrowing from the agile software development and project management philosophy, we introduce the idea of a light weight, agile approach to security risk management integrated to the development life cycle.

Original language	English
Title of host publication	2011 First International Workshop on Empirical Requirements Engineering (EmpiRE)
Publisher	IEEE
Pages	33-36
Number of pages	4
ISBN (Electronic)	978-1-4577-1076-6
ISBN (Print)	978-1-4577-1075-9
DOIs	https://doi.org/10.1109/EmpiRE.2011.6046253
Publication status	Published - Aug 2011
Event	First International Workshop on Empirical Requirements Engineering, EMPIRE 2011 - Trento, Italy Duration: 30 Aug 2011 → 30 Aug 2011 Conference number: 1 http://selab.fbk.eu/empire2011/

Publication series

Name	Workshop on Empirical Requirements Engineering (EmpiRE)
Publisher	IEEE Computer Society
Volume	2011
ISSN (Print)	2329-6348
ISSN (Electronic)	2329-6356

Workshop

Workshop	First International Workshop on Empirical Requirements Engineering, EMPIRE 2011
Abbreviated title	EmpiRE 2011
Country/Territory	Italy
City	Trento
Period	30/08/11 → 30/08/11
Internet address	http://selab.fbk.eu/empire2011/

Keywords

Information security risk management
SCS-Services
Security assurance
Secure engineering
Agile software development

Access to Document

10.1109/EmpiRE.2011.6046253

Franqueira2011towardsAccepted author version, 174 KB

Cite this

@inproceedings{effa6f1f21f140f7b508ea9cb35755d0,

title = "Towards Agile Security Risk Management in RE and Beyond",

abstract = "Little attention has been given so far to the process of security risk management at the early stages of system development. Security has been addressed by isolated security assurance practices, some of which consider risks and mitigations but they do not provide an overview of the overall security state of the system being developed. This paper takes the position that (1) these isolated security assurance practices should be fully integrated and should be embedded in short iterations of risk assessment, treatment and acceptance, providing input for updating security requirements and for security risk management, and that (2) available empirical data from public catalogs and databases should be used as a source of expertise, to leverage past experiences, and therefore reduce, although not eliminate, subjectivity of human judgment. Borrowing from the agile software development and project management philosophy, we introduce the idea of a light weight, agile approach to security risk management integrated to the development life cycle.",

keywords = "Information security risk management, SCS-Services, Security assurance, Secure engineering, Agile software development",

author = "Franqueira, {Virginia N.L.} and Zornitza Bakalova and Tun, {Thein Tan} and Maya Daneva",

year = "2011",

month = aug,

doi = "10.1109/EmpiRE.2011.6046253",

language = "English",

isbn = "978-1-4577-1075-9",

series = "Workshop on Empirical Requirements Engineering (EmpiRE)",

publisher = "IEEE",

pages = "33--36",

booktitle = "2011 First International Workshop on Empirical Requirements Engineering (EmpiRE)",

address = "United States",

note = "First International Workshop on Empirical Requirements Engineering, EMPIRE 2011, EmpiRE 2011 ; Conference date: 30-08-2011 Through 30-08-2011",

url = "http://selab.fbk.eu/empire2011/",

}

Franqueira, VNL, Bakalova, Z, Tun, TT & Daneva, M 2011, Towards Agile Security Risk Management in RE and Beyond. in 2011 First International Workshop on Empirical Requirements Engineering (EmpiRE). Workshop on Empirical Requirements Engineering (EmpiRE), vol. 2011, IEEE, pp. 33-36, First International Workshop on Empirical Requirements Engineering, EMPIRE 2011, Trento, Italy, 30/08/11. https://doi.org/10.1109/EmpiRE.2011.6046253

Towards Agile Security Risk Management in RE and Beyond. / Franqueira, Virginia N.L.; Bakalova, Zornitza; Tun, Thein Tan et al.
2011 First International Workshop on Empirical Requirements Engineering (EmpiRE). IEEE, 2011. p. 33-36 (Workshop on Empirical Requirements Engineering (EmpiRE); Vol. 2011).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

TY - GEN

T1 - Towards Agile Security Risk Management in RE and Beyond

AU - Franqueira, Virginia N.L.

AU - Bakalova, Zornitza

AU - Tun, Thein Tan

AU - Daneva, Maya

N1 - Conference code: 1

PY - 2011/8

Y1 - 2011/8

N2 - Little attention has been given so far to the process of security risk management at the early stages of system development. Security has been addressed by isolated security assurance practices, some of which consider risks and mitigations but they do not provide an overview of the overall security state of the system being developed. This paper takes the position that (1) these isolated security assurance practices should be fully integrated and should be embedded in short iterations of risk assessment, treatment and acceptance, providing input for updating security requirements and for security risk management, and that (2) available empirical data from public catalogs and databases should be used as a source of expertise, to leverage past experiences, and therefore reduce, although not eliminate, subjectivity of human judgment. Borrowing from the agile software development and project management philosophy, we introduce the idea of a light weight, agile approach to security risk management integrated to the development life cycle.

AB - Little attention has been given so far to the process of security risk management at the early stages of system development. Security has been addressed by isolated security assurance practices, some of which consider risks and mitigations but they do not provide an overview of the overall security state of the system being developed. This paper takes the position that (1) these isolated security assurance practices should be fully integrated and should be embedded in short iterations of risk assessment, treatment and acceptance, providing input for updating security requirements and for security risk management, and that (2) available empirical data from public catalogs and databases should be used as a source of expertise, to leverage past experiences, and therefore reduce, although not eliminate, subjectivity of human judgment. Borrowing from the agile software development and project management philosophy, we introduce the idea of a light weight, agile approach to security risk management integrated to the development life cycle.

KW - Information security risk management

KW - SCS-Services

KW - Security assurance

KW - Secure engineering

KW - Agile software development

U2 - 10.1109/EmpiRE.2011.6046253

DO - 10.1109/EmpiRE.2011.6046253

M3 - Conference contribution

SN - 978-1-4577-1075-9

T3 - Workshop on Empirical Requirements Engineering (EmpiRE)

SP - 33

EP - 36

BT - 2011 First International Workshop on Empirical Requirements Engineering (EmpiRE)

PB - IEEE

T2 - First International Workshop on Empirical Requirements Engineering, EMPIRE 2011

Y2 - 30 August 2011 through 30 August 2011

ER -

Towards Agile Security Risk Management in RE and Beyond

Abstract

Publication series

Workshop

Keywords

Access to Document

Fingerprint

Cite this