Security specifications of IT products and systems are inherently complex and may subject products to semantic threats due to misunderstanding of key aspects of security objectives by developers, customers and end users. A study is conducted on expressing the security specifications by specially interpreted UML use case diagrams to avoid misunderstanding by peer groups, i.e. to prevent semantic threats at the development phase through improved comprehension of security specifications. We base our results on engineering frameworks for comprehensive security and demonstrate the need for improved communication by concrete examples of semantic threats. The threats result from the use of complex textual artifacts as a means of communicating the security requirements. We demonstrate the use of a diagrammatic technique for expressing and communicating security specifications in a less ambiguous manner and illustrate how the technique assists in communication.
Twelve years ago a development program for security managers was started in Finland. The first program was designed to fulfil the needs of a security manager in an organization. However, the content was an educated guess. During the second program, in 1993, we made a study on how security managers themselves feel the requirements of their work and which part of their work they felt difficult or easy. We were interested in what kind of education security managers would need. These results were used when the following programs were planned and some extra courses were introduced. However, these results were never really published. Now, we try to improve the development program for security managers again. We took the results of the old study and found out the current situation. We noticed that the requirements for a security manager have changed. The security managers have become a manager of a department instead of a single specialist. They do not need as deep specialized knowledge as nine years ago. Instead they need understanding of business processes and managerial skills. Another finding is that security manager is a long term career. Few security managers have proceeded to higher vacancies. Instead many of those security managers who participated the old study as a security manager are now retiring from that very same position.
scite is a Brooklyn-based organization that helps researchers better discover and understand research articles through Smart Citations–citations that display the context of the citation and describe whether the article provides supporting or contrasting evidence. scite is used by students and researchers from around the world and is funded in part by the National Science Foundation and the National Institute on Drug Abuse of the National Institutes of Health.