The paper presents STAIRS [1], an approach to the compositional development of UML interactions supporting the specification of mandatory as well as potential behavior. STAIRS has been designed to facilitate the use of interactions for requirement capture as well as test specification. STAIRS assigns a precise interpretation to the various steps in incremental system development based on an approach to refinement known from the field of formal methods and provides thereby a foundation for compositional analysis. An interaction may characterize three main kinds of traces. A trace may be (1) positive in the sense that it is valid, legal or desirable, (2) negative meaning that it is invalid, illegal or undesirable, or (3) inconclusive meaning that it is considered irrelevant for the interaction in question. The basic increments in system development proposed by STAIRS, are structured into three main kinds referred to as supplementing, narrowing and detailing. Supplementing categorizes inconclusive traces as either positive or negative. Narrowing reduces the set of positive traces to capture new design decisions or to match the problem more adequately. Detailing involves introducing a more detailed description without significantly altering the externally observable behavior.

This paper presents the CORAS method for model-based security analysis. The presentation is case-driven. We follow two analysts in their interaction with an organisation by which they have been hired to carry out a security risk analysis. The analysis is divided into seven main steps, and the paper devotes a separate section to each of them. The paper focuses in particular on the use of the CORAS security risk modelling language as a means for communication and interaction during the seven steps.

The use of general descriptive names, registered names, trademarks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use. Cover design: KünkelLopka GmbH, HeidelbergPrinted on acid-free paper Springer is part of Springer Science+Business Media (www.springer.com) PrefaceExposure to risk is inescapable in most domains. People and families, enterprises, governments, private and public organisations, infrastructure providers, service providers, and so forth all encounter risks on an ongoing and frequent basis. The kinds of risks however vary from domain to domain, be it safety, economy, information and ICT security, politics, civil protection, emergency planning, defence, law, health, and so on. The need for understanding and managing risk is self-evident. Risk management is moreover in many cases imposed as a prerequisite, be it by law and legal regulations or from the public opinion, in particular within critical areas that may affect privacy and welfare, or even health and human life. In other cases, the lack of good routines, cultures and processes for managing risk may be a decisive factor for risks to emerge that should or could have been avoided.In this book, we present CORAS, which is a model-driven approach to risk analysis. Risk analysis is a core part of the overall process of risk management. In order to conduct risk analysis in practice, there is clearly a need for well-defined methods, techniques and guidelines for how to do this, and this is precisely what CORAS offers. Risk analysts, or for that matter anyone with a need for identifying and understanding risks, will in this book find guidance on how to conduct a stepwise, structured and systematic analysis and documentation of risks.The book also serves as an introduction to risk analysis in general, and as an introduction to the central and well-established underlying concepts and terminology. Practitioners, as well as graduate or undergraduate students, particularly within the IT domain, are therefore main target groups of this book. CORAS is strongly related to international standards on risk management, and this book therefore serves as an introduction to many of the issues that are addressed in these standards.An important objective of this book is to accompany standardised risk management guidelines and terminology with comprehensive pragmatic support. International standards generally focus on the what, but say little or nothing about the how. This book is a self-contained contribution not only to understand what risk management, risk analysis and risk related concepts are, but also to learn how to do risk analysis in practice. Extensive use of practical and illustrative examples furthermore facilitates a deep understanding of both the pragmatics and the conceptual aspects. v vi PrefaceThe comprehensiveness of CORAS is manifested by the three complementary parts of the approach. CORAS consists of a cust...

Abstract. STAIRS is an approach to the compositional development of sequence diagrams supporting the specification of mandatory as well as potential behavior. In order to express the necessary distinction between black-box and glass-box refinement, an extension of the semantic framework with three event messages is introduced. A concrete syntax is also proposed. The proposed extension is especially useful when describing time constraints. The resulting approach, referred to as Timed STAIRS, is formally underpinned by denotational trace semantics. A trace is a sequence of three kinds of events: events for transmission, reception and consumption. We argue that such traces give the necessary expressiveness to capture the standard UML interpretation of sequence diagrams as well as the black-box interpretation found in classical formal methods.

No abstract

No abstract

Abstract. The paper presents STAIRS, an approach to the compositional development of UML interactions supporting the specification of mandatory as well as potential behavior. STAIRS has been designed to facilitate the use of interactions for requirement capture as well as test specification. STAIRS assigns a precise interpretation to the various steps in incremental system development based on an approach to refinement known from the field of formal methods, and provides thereby a foundation for compositional analysis. An interaction may characterize three main kinds of traces. A trace may be (1) positive in the sense that it is valid, legal or desirable, (2) negative meaning that it is invalid, illegal or undesirable, or (3) considered irrelevant for the interaction in question. This categorization corresponds well with that of testing where the verdict of a test execution is either pass, fail or inconclusive. The basic increments in system development are structured into three kinds referred to as supplementing, narrowing and detailing. Supplementing categorizes inconclusive traces as either positive or negative. Narrowing reduces the set of positive traces to capture new design decisions or to match the problem more adequately. Detailing involves introducing a more detailed description without significantly altering the externally observable behavior.

Abstract. CORAS is a research and technological development project under the Information Society Technologies (IST) Programme (Commission of the European Communities, Directorate-General Information Society). One of the main objectives of CORAS is to develop a practical framework, exploiting methods for risk analysis, semiformal methods for object-oriented modelling, and computerised tools, for a precise, unambiguous, and efficient risk assessment of security critical systems. This paper presents the CORAS framework and the related conclusions from the CORAS project so far.