Eliciting Security Requirements and Tracing them to Design: An Integration of Common Criteria, Heuristics, and UMLsec

Building secure systems is difficult for many reasons. This paper deals with two of the main challenges: (i) the lack of security expertise in development teams, and (ii) the inadequacy of existing methodologies to support developers who are not security experts. The security standard ISO 14508 (Common Criteria) together with secure design techniques such as UMLsec can provide the security expertise, knowledge, and guidelines that are needed. However, security expertise and guidelines are not stated explicitly in the Common Criteria. They are rather phrased in security domain terminology and difficult to understand for developers. This means that some general security and secure design expertise are required to fully take advantage of the Common Criteria and UMLsec. In addition, there is the problem of tracing security requirements and objectives into solution design,which is needed for proof of requirements fulfilment. This paper describes a security requirements engineering methodology called SecReq. SecReq combines three techniques: the Common Criteria, the heuristic requirements editorHeRA, andUMLsec. SecReqmakes systematic use of the security engineering knowledge contained in the Common Criteria and UMLsec, as well as security-related heuristics in the HeRA tool. The integrated SecReq method supports early detection of security-related issues (HeRA), their systematic refinement guided by the Common Criteria, and the ability to trace security requirements into UML design models. A feedback loop helps reusing experiencewithin SecReq and turns the approach into an iterative process for the secure system life-cycle, also in the presence of system evolution.

‘To me, it's like a little box of tricks’: Breaking the depressive interlock as a programme participant in mindfulness-based cognitive therapy

Objectives. Mindfulness meditation practices have become increasingly popular in clinical therapies, changing patterns of depressogenic thinking for individuals who experience consecutive episodes of depression. We were interested in finding out how Mindfulness Based Cognitive Therapy (MBCT) worked for programme participants by focussing on how meditative practices changed their relationships to their thoughts. Design. Data for the study came from six semi-structured research interviews carried out with individuals who had taken part in an 8 week MBCT programme Methods. We used Interpretative Phenomenological Analysis (IPA) to analyse the experiential accounts. Results. We report on two superordinate themes – Engaging the Neutral Mind (with subordinate themes ‘breaking the paralysis of worry’ and ‘choosing to think differently’) and Experiencing the Neutral Mind (with subordinate themes of ‘reflection on previous thinking styles’ and ‘becoming psychologically self-reliant’). Conclusions. Themes from the present study offer support to the assertion that mindfulness meditation helps facilitate a different mode of meta-cognitive processing with which to handle depression-related cognitions. Practitioner Points Participants reported that they experienced an enhanced capacity to differentiate between their thought processes, experiencing an ability to tolerate some more uncomfortable thoughts and experiencing a/more choice in how to respond to thoughts Participants recognised that ruminating over negative thoughts was related to depressive states and experienced a shift in meta-cognitive processes that actively challenged depressogenic cognitions Participants became more psychologically self-reliant and therapeutically independent following MBCT Integrating mindfulness based practices in therapy may be a mediating factor in sustaining psychological wellbeing and may help clients develop self-compassion Future research looks to examining exit cases to understand elements of MBCT which are experienced as less successful by clients