Eliciting Security Requirements and Tracing them to Design: An Integration of Common Criteria, Heuristics, and UMLsec

Building secure systems is difficult for many reasons. This paper deals with two of the main challenges: (i) the lack of security expertise in development teams, and (ii) the inadequacy of existing methodologies to support developers who are not security experts. The security standard ISO 14508 (Common Criteria) together with secure design techniques such as UMLsec can provide the security expertise, knowledge, and guidelines that are needed. However, security expertise and guidelines are not stated explicitly in the Common Criteria. They are rather phrased in security domain terminology and difficult to understand for developers. This means that some general security and secure design expertise are required to fully take advantage of the Common Criteria and UMLsec. In addition, there is the problem of tracing security requirements and objectives into solution design,which is needed for proof of requirements fulfilment. This paper describes a security requirements engineering methodology called SecReq. SecReq combines three techniques: the Common Criteria, the heuristic requirements editorHeRA, andUMLsec. SecReqmakes systematic use of the security engineering knowledge contained in the Common Criteria and UMLsec, as well as security-related heuristics in the HeRA tool. The integrated SecReq method supports early detection of security-related issues (HeRA), their systematic refinement guided by the Common Criteria, and the ability to trace security requirements into UML design models. A feedback loop helps reusing experiencewithin SecReq and turns the approach into an iterative process for the secure system life-cycle, also in the presence of system evolution.

Psychotherapy in a neoliberal world

The neoliberal regime has significant consequences for the psychotherapies. In particular, the idea that individuals is deserving of support from society and government when they need it – for example in managing the inevitable stresses of the life cycle – is being displaced by an ideology of total individual responsibility. Psychotherapies framed around relational conceptions of the self find themselves particularly out of key with this dominant way of thinking. Governmental approaches to developmental needs become more instrumental, measurement-oriented and ‘disciplinary’ in this situation. Market incentives and disciplinary sanctions are introduced to ensure that institutions and their personnel conform to governmental directives. There is pressure on psychotherapists to adapt to this instrumentalised environment to survive. However, ‘expressive individualisation’ was also stimulated by the cultural liberation of the 1960s, and survives alongside the ‘possessive individualism’ of neoliberalism. This alternative culture has not been entirely suppressed, and therapies continue to be sought which offer the possibility of self-understanding and growth, although the pressure is for such therapies to become luxury goods. What is at risk under neoliberalism is the idea that society should support the self-development and self-understanding of all its citizens, as an aspect of a modern kind of democratic citizenship.