ICSE

Security is often an afterthought when developing software, and is often bolted on late in development or even during deployment or maintenance, through activities such as penetration testing, add-on security software and penetrate-and patch ...

This paper proposes a way of extending eXtreme Programming (XP) practices, in particular the original planning game and the coding guidelines, to aid the developers and the customer to engineer security requirements while maintaining the iterative and ...

Code obfuscators are widely used tools for protecting commercial Java software. Advanced obfuscation techniques make de-compiled Java programs not re-compilable, thus greatly raising the barrier of instrumenting Java bytecode for malicious purpose. ...

From a software engineering perspective, using Aspect-Oriented Programming (AOP) to build secure software has clear advantages. Until recently, the security perspective of this approach has been given less attention, however. This paper analyses the ...

This paper presents a framework for security requirements elicitation and analysis, based upon the construction of a context for the system and satisfaction arguments for the security of the system. One starts with enumeration of security goals based on ...

Establishing secure systems assurance based on Certification and Accreditation (C&A) activities, requires effective ways to understand the enforced security requirements, gather relevant evidences, perceive related risks in the operational environment, ...

Software engineering today relies to a large extent on acquiring and composing software components and other software-related artifacts from different producers, either at design or at run time. For any user of such artifacts, both as developer and as ...

This paper reports on our experience of using Alloy for analysis of system design in regard to changes in the security requirements. It presents some of technical details for the specification and analysis of the JAAS framework. The declarative way of ...

Network Intrusion Detection Systems (NIDSs) can be composed of a potentially large number of sensors, which monitor the traffic flowing in the network. Deciding where sensors should be placed and what information they need in order to detect the desired ...