Software Engineering, International Conference on (2007)
May 20, 2007 to May 26, 2007
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/ICSE.2007.55
Bastian Best , BMW Group, Germany
Jan Jurjens , The Open University, UK
Bashar Nuseibeh , The Open University, UK
Given the explosive growth of digitally stored information in modern enterprises, distributed information systems together with search engines are increasingly used in companies. By enabling the user to search all relevant information sources with one single query, however, crucial risks concerning information security arise. In order to make these applications secure, it is not sufficient to penetrate- and-patch past system development, but security analysis has to be an integral part of the system design process for such distributed information systems. This work presents the experiences and results of the security analysis of a search engine in the intranet of a German car manufacturer, by making use of an approach to model-based security engineering that is based on the UML extension UMLsec. The focus lies on the application's single-sign-on-mechanism, which was analyzed using the UMLsec method and tools. Main results of the paper include afield report on the employment of the UMLsec method in an industrial context as well as indications on its benefits and limitations.
distributed processing, search engines, security of data, Unified Modeling Language
B. Best, J. Jurjens and B. Nuseibeh, "Model-Based Security Engineering of Distributed Information Systems Using UMLsec," 29th International Conference on Software Engineering (ICSE'07)(ICSE), Minneapolis, MN, 2009, pp. 581-590.