CyberSPL: A Framework for the Verification of Cybersecurity Policy Compliance of System Configurations Using Software Product Lines

Abstract

Cybersecurity attacks affect the compliance of cybersecurity policies of the organisations. Such disadvantages may be due to the absence of security configurations or the use of default configuration values of software products and systems. The complexity in the configuration of products and systems is a known challenge in the software industry since it includes a wide range of parameters to be taken into account. In other contexts, the configuration problems are solved using Software Product Lines. This is the reason why in this article the framework Cybersecurity Software Product Line (CyberSPL) is proposed. CyberSPL is based on a methodology to design product lines to verify cybersecurity policies according to the possible configurations. The patterns to configure the systems related to the cybersecurity aspects are grouped by defining various feature models. The automated analysis of these models allows us to diagnose possible problems in the security configurations, reducing or avoiding them. As support for this proposal, a multi-user and multi-platform solution has been implemented, enabling setting a catalogue of public or private feature models. Moreover, analysis and reasoning mechanisms have been integrated to obtain all the configurations of a model, to detect if a configuration is valid or not, including the root cause of problems for a given configuration. For validating the proposal, a real scenario is proposed where a catalogue of four different feature models is presented. In this scenario, the models have been analysed, different configurations have been validated, and several configurations with problems have been diagnosed.

Reasoning on the usage control security policies over data artifact business process models

“…Currently, monitoring and process mining techniques are new trends in order to detect whether certain security requirements are fulfilled by analyzing event logs [1,6]. The work in [52] enables the generation of security configuration workflows, whereas [50] provides a framework to design product lines to verify security policies in accordance to a set of available configurations. Nevertheless, these works only consider the activitycentric perspective and overlook the artifact-centric perspective in most cases.…”

Security and Privacy of QR Code Applications: A Comprehensive Study, General Guidelines and Solutions

“…However, giving permissions can be extremely dangerous, especially from a privacy perspective, as an attacker may access private data and may run an information leakage attack. The problem of correctly configuring systems so to protect the user privacy is a very challenging task in general and has been widely studied also in other contexts, e.g., to correctly configure TLS/SSL connections in mobile applications [118], or to configure products and systems in the software industry [119]. In this section, we will illustrate the available apps that adopt balanced permissions that meet the privacy requirements.…”

Definition and Verification of Security Configurations of Cyber-Physical Systems

“…Most of the approaches in the literature make a transformation from the FMs to a formalisation, for instance, Constraint Satisfaction Problems (CSPs) or Constraint Optimisation Problems (COPs) [14]. In this work, the tools used to automated the analysis are FaMa and CyberSPL [9,39], both based on the Constraint Programming paradigm.…”