Security Compliance in Model-driven Development of Software Systems in Presence of Long-Term Evolution and Variants

Ensuring software system security requires keeping up with changing security precautions, attacks, and mitigations. Model-based development enables addressing security at design-time, but design models can be inconsistent and vary across variants. To address this, we present an approach based on continuous automated change propagation, allowing security experts to specify security requirements on the most suitable system representation. We automatically check all system representations against these requirements and provide security-preserving refactorings. We demonstrate the approach in two open-source case studies, the iTrust electronics health records system and the Eclipse Secure Storage.

Format: Paperback / softback
Length: 476 pages
Publication date: 14 July 2022
Publisher: Springer Fachmedien Wiesbaden

Ensuring the security of a software system is of paramount importance, necessitating a proactive approach to keep abreast of evolving security precautions, attacks, and mitigations. While model-based development offers the advantage of addressing security concerns during the design phase, it often results in inconsistencies between design models and their implementation or among themselves. Furthermore, the presence of variants in software systems adds an additional layer of complexity. In this context, we present an approach that leverages continuous automated change propagation to enable security experts to specify security requirements on the most suitable system representation. Our system automatically performs a comprehensive check against these requirements, identifying security-preserving refactorings that maintain compliance with security standards.

We demonstrate the applicability of our approach to variant-rich software systems, showcasing its effectiveness in supporting legacy systems through reverse-engineering variability-aware UML models and semi-automatic mapping of existing design models to the implementation. Furthermore, we provide comprehensive evaluations of the individual contributions of our approach through two open-source case studies: the iTrust electronics health records system and the Eclipse Secure Storage.

By adopting our approach, software development teams can enhance the security posture of their systems and mitigate the risks associated with evolving security threats.

Weight: 663g
Dimension: 210 x 148 (mm)
ISBN-13: 9783658376642
Edition number: 1st ed. 2022