Aligning Security and Privacy to Support the Development of Secure Information Systems

Haralambos Mouratidis (University of East London, United Kingdom)

Christos Kalloniatis (University of the Aegean, Greece)

Shareeful Islam (University of East London, United Kingdom)

Marc-Philippe Huget (University of Savoie, France)

Stefanos Gritzalis (University of the Aegean, Greece)

Abstract: The increasing dependency on information systems to process and manage sensitive information requires the usage of development methods that support the development of secure and private information systems. The literature provides examples of methods that focus on security and privacy individually but fail to provide evidence of information systems development methods that consider security and privacy in a unified framework. Security and privacy are very much related, in particular certain security properties and mechanisms support the achievement of privacy goals. Without a development framework to support developers to explicitly model that relationship, conflicts and vulnerabilities can be introduced to a system design that might endanger its security. In this paper, we present our work in developing a framework that supports the unified analysis of privacy and security. In particular, we present a meta-model that combines concepts from security and privacy requirements methods, such as security and privacy goals, properties, constraints, and actor and process patterns within a social context. A real case study is employed to demonstrate the applicability of our work.

Keywords: constraints, goal modelling, meta-model, privacy, security

Categories: D.2.1, D.2.2, H.1, K.6.5