Eliciting Security Requirements and Tracing them to Design: An Integration of Common Criteria, Heuristics, and UMLsec

Building secure systems is difficult for many reasons. This paper deals with two of the main challenges: (i) the lack of security expertise in development teams, and (ii) the inadequacy of existing methodologies to support developers who are not security experts. The security standard ISO 14508 (Common Criteria) together with secure design techniques such as UMLsec can provide the security expertise, knowledge, and guidelines that are needed. However, security expertise and guidelines are not stated explicitly in the Common Criteria. They are rather phrased in security domain terminology and difficult to understand for developers. This means that some general security and secure design expertise are required to fully take advantage of the Common Criteria and UMLsec. In addition, there is the problem of tracing security requirements and objectives into solution design,which is needed for proof of requirements fulfilment. This paper describes a security requirements engineering methodology called SecReq. SecReq combines three techniques: the Common Criteria, the heuristic requirements editorHeRA, andUMLsec. SecReqmakes systematic use of the security engineering knowledge contained in the Common Criteria and UMLsec, as well as security-related heuristics in the HeRA tool. The integrated SecReq method supports early detection of security-related issues (HeRA), their systematic refinement guided by the Common Criteria, and the ability to trace security requirements into UML design models. A feedback loop helps reusing experiencewithin SecReq and turns the approach into an iterative process for the secure system life-cycle, also in the presence of system evolution.

Life after Stroke: Coping mechanisms among African Caribbean Women

In the UK stroke is the third most common cause of death for women and the incidence in African Caribbean women is higher than the general population. Stroke burden has major consequences for the physical, mental and social health of African Caribbean women. In order to adjust to life after stroke individuals affected employ a range of strategies which may include personal, religious (church) or spiritual support (i.e. prayer), individual motivation, or resignation to life with a disability. This study explored these areas through the coping mechanisms that African Caribbean women utilised post stroke in the context of stroke recovery and lifestyle modification efforts needed to promote healthy living post stroke. A qualitative approach using Interpretative Phenomenological Analysis was adopted. Eight women were recruited into the study. Semi structured in-depth interviews were audio recorded and were transcribed verbatim. Data were analysed using a four-stage framework: familiarisation, sense making, developing themes and data refinement and analysis. Three main themes on coping emerged: the need to follow medical rules to manage stroke, strength and determination, and the use of religion and faith to cope with life after stroke. These findings illustrate both a tension between religious beliefs and the medical approach to stroke and highlight the potential benefits that religion and the church can play in stroke recovery. Implications for practice include acknowledgement and inclusion of religion and church based health promotion in post stroke recovery.