Eliciting Security Requirements and Tracing them to Design: An Integration of Common Criteria, Heuristics, and UMLsec

Building secure systems is difficult for many reasons. This paper deals with two of the main challenges: (i) the lack of security expertise in development teams, and (ii) the inadequacy of existing methodologies to support developers who are not security experts. The security standard ISO 14508 (Common Criteria) together with secure design techniques such as UMLsec can provide the security expertise, knowledge, and guidelines that are needed. However, security expertise and guidelines are not stated explicitly in the Common Criteria. They are rather phrased in security domain terminology and difficult to understand for developers. This means that some general security and secure design expertise are required to fully take advantage of the Common Criteria and UMLsec. In addition, there is the problem of tracing security requirements and objectives into solution design,which is needed for proof of requirements fulfilment. This paper describes a security requirements engineering methodology called SecReq. SecReq combines three techniques: the Common Criteria, the heuristic requirements editorHeRA, andUMLsec. SecReqmakes systematic use of the security engineering knowledge contained in the Common Criteria and UMLsec, as well as security-related heuristics in the HeRA tool. The integrated SecReq method supports early detection of security-related issues (HeRA), their systematic refinement guided by the Common Criteria, and the ability to trace security requirements into UML design models. A feedback loop helps reusing experiencewithin SecReq and turns the approach into an iterative process for the secure system life-cycle, also in the presence of system evolution.

A qualitative study of the emotional coping and support needs of children living with a parent with a brain injury

Primary objective: To examine emotional coping and support needs in children of persons with acquired brain injury, with a view to understanding what interventions would be helpful for these children. Design: The study was qualitative, using a thematic analysis approach. Methods and procedure: Six children between 9 and 18 years of age, six parents (three with ABI), and three support workers were interviewed either at home or at a support centre, using a semi-structured interview guide. Results: Children reported using a variety of adaptive and maladaptive emotional coping strategies, but were consistent in expressing a need for credible validation, i.e. sharing experiences with peers. The results are presented under four overarching themes: difficulties faced; emotions experienced; coping strategies; and reported support needs. Conclusions: The results reveal an interaction between the child’s experiences of complex loss that is difficult to acknowledge, emotional distancing between parent and child, and the children’s need for credible validation. All children expressed a desire for talking to peers in a similar situation to themselves, but had not had this opportunity. Interventions should set up such peer interaction to create credible validation for the specific distress suffered by this population.