Knowledge Base for an Intelligent System in order to Identify Security Requirements for Government Agencies Software Projects
It has been evidenced that one of the most common causes in the failure of software security is the lack of identification and specification of requirements for information security, it is an activity with an insufficient importance in the software development or software acquisition We propose the...
| Main Authors: | , , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
EDP Sciences
2016-01-01
|
| Series: | MATEC Web of Conferences |
| Online Access: | http://dx.doi.org/10.1051/matecconf/20167603012 |
| _version_ | 1818963689561128960 |
|---|---|
| author | Adán Beltrán G. Cristhian Lombana C. Mario Calvo L. Sonia Ordoñez S. Yaneth Caviativa C. Jairo Garcés |
| author_facet | Adán Beltrán G. Cristhian Lombana C. Mario Calvo L. Sonia Ordoñez S. Yaneth Caviativa C. Jairo Garcés |
| author_sort | Adán Beltrán G. |
| collection | DOAJ |
| description | It has been evidenced that one of the most common causes in the failure of software security is the lack of identification and specification of requirements for information security, it is an activity with an insufficient importance in the software development or software acquisition We propose the knowledge base of CIBERREQ. CIBERREQ is an intelligent knowledge-based system used for the identification and specification of security requirements in the software development cycle or in the software acquisition. CIBERREQ receives functional software requirements written in natural language and produces non-functional security requirements through a semi-automatic process of risk management. The knowledge base built is formed by an ontology developed collaboratively by experts in information security. In this process has been identified six types of assets: electronic data, physical data, hardware, software, person and service; as well as six types of risk: competitive disadvantage, loss of credibility, economic risks, strategic risks, operational risks and legal sanctions. In addition there are defined 95 vulnerabilities, 24 threats, 230 controls, and 515 associations between concepts. Additionally, automatic expansion was used with Wikipedia for the asset types Software and Hardware, obtaining 7125 and 5894 software and hardware subtypes respectively, achieving thereby an improvement of 10% in the identification of the information assets candidates, one of the most important phases of the proposed system. |
| first_indexed | 2024-12-20T12:49:13Z |
| format | Article |
| id | doaj.art-2991cb6b34784603ba1a87043765e842 |
| institution | Directory Open Access Journal |
| issn | 2261-236X |
| language | English |
| last_indexed | 2024-12-20T12:49:13Z |
| publishDate | 2016-01-01 |
| publisher | EDP Sciences |
| record_format | Article |
| series | MATEC Web of Conferences |
| spelling | doaj.art-2991cb6b34784603ba1a87043765e8422022-12-21T19:40:13ZengEDP SciencesMATEC Web of Conferences2261-236X2016-01-01760301210.1051/matecconf/20167603012matecconf_cscc2016_03012Knowledge Base for an Intelligent System in order to Identify Security Requirements for Government Agencies Software ProjectsAdán Beltrán G.0Cristhian Lombana C.1Mario Calvo L.2Sonia Ordoñez S.3Yaneth Caviativa C.4Jairo Garcés5Grupo de Investigación en Ingenieria de Software. Vicerrectoría de Investigaciones. Universidad Manuela BeltránGrupo de Investigación en Ingenieria de Software. Vicerrectoría de Investigaciones. Universidad Manuela BeltránGrupo de Investigación en Ingenieria de Software. Vicerrectoría de Investigaciones. Universidad Manuela BeltránGrupo de Investigación en Ingenieria de Software. Vicerrectoría de Investigaciones. Universidad Manuela BeltránGrupo de Investigación en Ingenieria de Software. Vicerrectoría de Investigaciones. Universidad Manuela BeltránGrupo de Investigación en Ingenieria de Software. Vicerrectoría de Investigaciones. Universidad Manuela BeltránIt has been evidenced that one of the most common causes in the failure of software security is the lack of identification and specification of requirements for information security, it is an activity with an insufficient importance in the software development or software acquisition We propose the knowledge base of CIBERREQ. CIBERREQ is an intelligent knowledge-based system used for the identification and specification of security requirements in the software development cycle or in the software acquisition. CIBERREQ receives functional software requirements written in natural language and produces non-functional security requirements through a semi-automatic process of risk management. The knowledge base built is formed by an ontology developed collaboratively by experts in information security. In this process has been identified six types of assets: electronic data, physical data, hardware, software, person and service; as well as six types of risk: competitive disadvantage, loss of credibility, economic risks, strategic risks, operational risks and legal sanctions. In addition there are defined 95 vulnerabilities, 24 threats, 230 controls, and 515 associations between concepts. Additionally, automatic expansion was used with Wikipedia for the asset types Software and Hardware, obtaining 7125 and 5894 software and hardware subtypes respectively, achieving thereby an improvement of 10% in the identification of the information assets candidates, one of the most important phases of the proposed system.http://dx.doi.org/10.1051/matecconf/20167603012 |
| spellingShingle | Adán Beltrán G. Cristhian Lombana C. Mario Calvo L. Sonia Ordoñez S. Yaneth Caviativa C. Jairo Garcés Knowledge Base for an Intelligent System in order to Identify Security Requirements for Government Agencies Software Projects MATEC Web of Conferences |
| title | Knowledge Base for an Intelligent System in order to Identify Security Requirements for Government Agencies Software Projects |
| title_full | Knowledge Base for an Intelligent System in order to Identify Security Requirements for Government Agencies Software Projects |
| title_fullStr | Knowledge Base for an Intelligent System in order to Identify Security Requirements for Government Agencies Software Projects |
| title_full_unstemmed | Knowledge Base for an Intelligent System in order to Identify Security Requirements for Government Agencies Software Projects |
| title_short | Knowledge Base for an Intelligent System in order to Identify Security Requirements for Government Agencies Software Projects |
| title_sort | knowledge base for an intelligent system in order to identify security requirements for government agencies software projects |
| url | http://dx.doi.org/10.1051/matecconf/20167603012 |
| work_keys_str_mv | AT adanbeltrang knowledgebaseforanintelligentsysteminordertoidentifysecurityrequirementsforgovernmentagenciessoftwareprojects AT cristhianlombanac knowledgebaseforanintelligentsysteminordertoidentifysecurityrequirementsforgovernmentagenciessoftwareprojects AT mariocalvol knowledgebaseforanintelligentsysteminordertoidentifysecurityrequirementsforgovernmentagenciessoftwareprojects AT soniaordonezs knowledgebaseforanintelligentsysteminordertoidentifysecurityrequirementsforgovernmentagenciessoftwareprojects AT yanethcaviativac knowledgebaseforanintelligentsysteminordertoidentifysecurityrequirementsforgovernmentagenciessoftwareprojects AT jairogarces knowledgebaseforanintelligentsysteminordertoidentifysecurityrequirementsforgovernmentagenciessoftwareprojects |