Enhancing Security Requirements Engineering by Organisational Learning

More and more software projects today are security-related in one way or the other. Requirements engineers often fail to recognise indicators for security problems which is a major source of security problems in practice. Identifying security-relevant requirements is labour-intensive and errorprone. In order to facilitate the security requirements elicitation process, we present an approach supporting organisational learning on security requirements by establishing company-wide experience resources, and a socio-technical network to benefit from them. The approach is based on modelling the flow of requirements and related experiences. Based on those models, we enable people to exchange experiences about security-requirements while they write and discuss project requirements. At the same time, the approach enables participating stakeholders to learn while they write requirements. This can increase security awareness and facilitate learning on both individual and organisational levels. As a basis for our approach, we introduce heuristic assistant tools which support reuse of existing security-related experiences. In particular, they include Bayesian classifiers which issue a warning automatically when new requirements seem to be security-relevant. Our results indicate that this is feasible, in particular if the classifier is trained with domain specific data and documents from previous projects. We show how the ability to identify security-relevant requirements can be improved using this approach. We illustrate our approach by providing a step-by-step example of how we improved the security requirements engineering process at the European Telecommunications Standards Institute (ETSI) and report on experiences made in this application.

Eliciting Security Requirements and Tracing them to Design: An Integration of Common Criteria, Heuristics, and UMLsec

Building secure systems is difficult for many reasons. This paper deals with two of the main challenges: (i) the lack of security expertise in development teams, and (ii) the inadequacy of existing methodologies to support developers who are not security experts. The security standard ISO 14508 (Common Criteria) together with secure design techniques such as UMLsec can provide the security expertise, knowledge, and guidelines that are needed. However, security expertise and guidelines are not stated explicitly in the Common Criteria. They are rather phrased in security domain terminology and difficult to understand for developers. This means that some general security and secure design expertise are required to fully take advantage of the Common Criteria and UMLsec. In addition, there is the problem of tracing security requirements and objectives into solution design,which is needed for proof of requirements fulfilment. This paper describes a security requirements engineering methodology called SecReq. SecReq combines three techniques: the Common Criteria, the heuristic requirements editorHeRA, andUMLsec. SecReqmakes systematic use of the security engineering knowledge contained in the Common Criteria and UMLsec, as well as security-related heuristics in the HeRA tool. The integrated SecReq method supports early detection of security-related issues (HeRA), their systematic refinement guided by the Common Criteria, and the ability to trace security requirements into UML design models. A feedback loop helps reusing experiencewithin SecReq and turns the approach into an iterative process for the secure system life-cycle, also in the presence of system evolution.

Amino acid requirements of white seabream (Diplodus sargus) larvae: effects on growth and performance

Tese dout., Aquacultura, Universidade do Algarve, 2008

Differential requirements of aPKC activity within different epithelial tissues

Epithelial tissues are essential during morphogenesis and organogenesis. During development, epithelial tissues undergo several different remodeling processes, from cell intercalation to cell change shape. An epithelial cell has a highly polarized structure, which is important to maintain tissue integrity. The mechanisms that regulate and maintain apicobasal polarity and epithelial integrity are mostly conserved among all species and in different tissues within the same organism. aPKC-PAR complex localizes in the apical domain of polarized cells, and its function is essential for apicobasal polarization and epithelial integrity. In this work we characterized two novel alleles of aPKC: a temperature sensitive allele (aPKCTS), which has a point mutation on a kinase domain, and another allele with a point mutation on a highly conserved amino acid within the PB1 domain of aPKC (aPKCPB1). Analysis of the aPKCTS mutant phenotypes, lead us to propose that during development different epithelial tissues have differential requirements of aPKC activity. More specifically, our work suggests de novo formation of adherens junctions (AJs) is particularly sensitive to sub-optimal levels of apkc activity. Analysis of the aPKCPB1 allele, suggests that aPKC is likely to have an apical structural function mostly independent of its kinase activity. Altogether our work suggests that although loss of aPKC function is associated to similar epithelial phenotypes (e.g., loss of apicobasal polarization and epithelial integrity), the requirements of aPKC activity within these tissues are nevertheless likely to vary.

Germination requirements of Plantago algarbiensis seeds, an endangered species endemic to the Algarve region (South of Portugal)

The ecdysteroid, 20-hydroxyecdysone or beta-ecdysone, is a steroid hormone which plays a crucial role in molting, metamor- phosis and reproduction of arthropods. This ecdysteroid and its analogues have high potential to be used as insecticides. Previous studies in our laboratory have demonstrated that Vitex glabrata R.Br. (commonly known as Khai-Nao), an indigenous herbaceous plant of Thailand, synthesized and accumulated high quantity of 20-hydroxyecdysone. Therefore, the aim of this study was to investigate the effect of precursor and elicitors feeding on cell growth and 20-hydroxyecdysone production of V. glabrata suspension cultures. Plant cells were cultured in half strength MS medium containing 30 g/l glucose and supplemented with 2.0 mg/l 6- benzylaminopurine (BAP) and 1.0 mg/l 2,4-dichlorophenoxyacetic acid (2,4-D). Cells were incubated on a rotary shaker at 120 rpm under continuous light of 2000 lux at 25 °C. Sterilized cholesterol (5 and 10 mg/l) as precursor was added to the cell cultures on the day of inoculation, while chitosan (50, 100 and 200 mg/l) and methyl jusmonate (100 and 200 mM) as elicitors were added to the cell cultures on day 6 after cultivation.

Acoustic oceanographic buoy telemetry system: an ‘advanced’ sonobuoy that meets acoustic rapid environmental assessment requirements

The Acoustic Oceanographic Buoy (AOB) Telemetry System has been designed to meet acoustic rapid environmental assessment requirements. It uses a standard institute of Electrical and Electronics Engineers 802.11 wireless local area network (WLAN) to integrate the air radio network (RaN) and a hydrophone array and acoustic source to integrate the underwater acoustic network (AcN). It offers advantages including local data storage, dedicated signal processing, and global positioning system (GPS) timing and localization. The AOB can also be integrated with other similar systems, due to its WLAN transceivers, to form a flexible network and perform on-line high speed data transmissions. The AOB is a reusable system that requires less maintenance and can also work as a salt-water plug-and-play system at sea as it is designed to operate in free drifting mode. The AOB is also suitable for performing distributed digital signal processing tasks due to its digital signal processor facility.

From design-for-test to design-for-debug-and-test: analysis of requirements and limitations for 1149.1

The increasing complexity of VLSI circuits and the reduced accessibility of modern packaging and mounting technologies restrict the usefulness of conventional in-circuit debugging tools, such as in-circuit emulators for microprocessors and microcontrollers. However, this same trend enables the development of more complex products, which in turn require more powerful debugging tools. These conflicting demands could be met if the standard scan test infrastructures now common in most complex components were able to match the debugging requirements of design verification and prototype validation. This paper analyses the main debug requirements in the design of microprocessor-based applications and the feasibility of their implementation using the mandatory, optional and additional operating modes of the standard IEEE 1149.1 test infrastructure.

Options and Requirements for a potential market entry into Portugal with renewable energy technologies that are applicable for heating and cooling of buildings

NSBE-UNL

Managing marginal capital requirements in solvency II: Analysis of a real insurance portfolio

This thesis provides a complete analysis of the Standard Capital Requirements given by Solvency II for a real insurance portfolio. We analyze the investment portfolio of BPI Vida e Pensões, an insurance company affiliated with a Portuguese bank BPI, both at security, sub-portfolio and asset class levels. By using the Standard Formula from EIOPA, Total SCR amounts to 239M€. This value is mostly explained by Market and Default Risk whereas the former is driven by Spread and Concentration Risks. Following the methodology of Leblanc (2011), we examine the Marginal Contribution of an asset to the SCR which allows for the evaluation of the risks of each security given its characteristics and interactions in the portfolio. The top contributors to the SCR are Corporate Bonds and Term Deposits. By exploring further the composition of the portfolio, our results show that slight changes in allocation of Term and Cash Deposits have severe impacts on the total Concentration and Default Risks, respectively. Also, diversification effects are very relevant by representing savings of 122M€. Finally, Solvency II represents an opportunity for the portfolio optimization. By constructing efficient frontiers, we find that as the target expected return increases, a shift from Term Deposits/ Commercial Papers to Eurozone/Peripheral and finally Equities occurs.

Basel III new capital requirements, impacts and bank behavior

For some years, researchers could not find a clear effect of capital adequacy on the risk profile of banks, as shareholders could increase the riskiness of the assets (qualitative effect), crowding-out the effect of reduced leverage (volume effect). Some shareholders might have the will to increase the riskiness of the assets, but they may lack the power to do so. Considering only ”powerful” shareholders, definitive conclusions were drawn but with constant ownership profile. In this paper I investigate whether there is a significant change in the type of shareholders in response to regulatory capital shocks and, if so, will the banking system be in the hands of more “desired” shareholders. I find that ownership profile responds to a regulatory shock, changing the risk appetite of the ruling power at the bank. I find more banks and the government in the ownership of undercapitalised banks and much less institutional shareholders and free float. I claim that these new shareholders may not the desired ones, given the objective of the regulatory change, as they are associated with a preference for more leverage. One possible explanation for this crowding-out effect is that regulators are trying to contain idiosyncratic risk (more linked to the riskiness of the assets) with a rule that contains systematic risk (capital adequacy). This has a distorting effect on ownership. Another insight can be drawn from the tests: supervisors should be aware of significant ownership movements that cause the crowding-out.

Basel III: The impact of new capital requirements on profitability of Portuguese Banks

This empirical study aims to explore the impact of increased capital ratio requirements, on the ROE of the Portuguese banking sector. The paper employs both a quantitative- and qualitative approach, with the qualitative approach as the main method of research. The method adopted to conduct the qualitative research was semi structured elite interviews with banking executives. Higher capital requirements decrease the ROE of banks in Portugal, but huge impairments charges, macroeconomic factors and increased costs of deposits are clearly the dominant reasons for the reduced levels of ROE the past years. Among the measures taken to increase capital ratios, reduction of RWAs and non-core assets have been the main focus, but the issuance of CoCos is regarded as the most expensive measure due to high interest payments. However, the CoCos will not have any effect on the ROE in the long term. It is difficult to draw any conclusions on the impact of more equity in the balance sheet on the ROE of Portuguese banks, as many banks currently don’t generate enough money to pay back on shareholders´ investments.

Retrospective research: What are the ethical and legal requirements?

Retrospective research is conducted on already available data and/or biologic material. Whether such research requires that patients specifically consent to the use of "their" data continues to stir controversy. From a legal and ethical point of view, it depends on several factors. The main criteria to be considered are whether the data or the sample is anonymous, whether the researcher is the one who collected it and whether the patient was told of the possible research use. In Switzerland, several laws delineate the procedure to be followed. The definition of "anonymous" is open to some interpretation. In addition, it is debatable whether consent waivers that are legally admissible for data extend to research involving human biological samples. In a few years, a new Swiss federal law on human research could clarify the regulatory landscape. Meanwhile, hospital-internal guidelines may impose stricter conditions than required by federal or cantonal law. Conversely, Swiss and European ethical texts may suggest greater flexibility and call for a looser interpretation of existing laws. The present article provides an overview of the issues for physicians, scientists, ethics committee members and policy makers involved in retrospective research in Switzerland. It aims at provoking more open discussions of the regulatory problems and possible future legal and ethical solutions.

Record keeping by Swiss physiotherapists--a national survey of knowledge regarding legal requirements.

A national survey conducted in Switzerland aimed to evaluate the knowledge of physiotherapists regarding the legal requirements for record keeping and to collect their feedback about record keeping in general. Three physiotherapists from various professional practice groups and a lawyer specialised in health law developed a questionnaire that was sent to the 7,753 members of two existing national associations of physiotherapists. The questionnaire evaluated the participants' knowledge by calculating a score of legal knowledge, which had a maximum of 30 points. We included 825 questionnaires in the analysis. The large majority (83.4%) of participants confessed an ignorance of the legal requirements concerning record keeping prior to the survey. The average score of legal compatibility was 8 points. The younger age of the physiotherapists was a significant predictor of having knowledge of the legal requirements for record keeping (p <0.001). The participants had an appreciation of the value of records, but they did not have the relevant knowledge regarding the legal requirements for keeping records. The participants blamed a lack of time and remuneration for their failure to keep records according to known requirements. All practising allied health professionals should keep up-to-date and accurate records that conform to active legal requirements and existing international guidelines. In addition to the existing legal requirements, the emergence of e-health and the electronic era will trigger major changes in patient record management by physiotherapists.

The Literary relations between La Fontaine and the "Astrée" of Honoré d'Urfé : a dissertation presented to the faculty of the department of philosophy of the university of Pennsylvania in partial fulfilment of the requirements for the degree of doctor of philosophy / by Walther P. Fischer

Collection : Publications of the University of Pennsylvania ; n° 6