Enhancing Misuse Cases With Risk Assessment for Safety Requirements

Abstract

Risk-driven requirements elicitation represents an approach that allows assignment of appropriate countermeasure for the protection of the Information System (IS) depending on the risk level. Elicitation of safety requirements based on risk analysis is essential for those IS which will run on the open and dynamic Internet platform. Traditionally, misuse cases are used to find the weak points of an IS but cannot differentiate between the weak point that can lead to lenient hazard and/or serious hazard. In this paper, we present an enhanced misuse case approach to support IS safety risk assessment at the early stages of software process. We extensively examined and identified concepts which constitute a modelling technique for IS safety risk assessment and build a conceptual model for achieving IS safety risk assessment during the requirement analysis phase of software process. The risk assessment process follows an approach of consequential analysis based on misuse cases for safety hazard identification and qualitative risk measurement. The safety requirements are elicited according to the results of the risk assessment. A medical IS is used as a case study to validate the proposed model. INDEX TERMS Misuse case, requirements engineering, risk assessment, scenario, safety, use cases.

Safety Requirements Analysis using Misuse Cases Method

“…Adoption is achieved by exploring threats from failures of the system itself and mistakes made by users. Arogundade demonstrated enhancement to misuse case method by introducing iterative risk assessment to improve proposed preventive actions [1].…”

“…One of the main advantages of using misuse cases for security is to show a series of unwanted actions from different perspectives sequentially [1]. By adopting misuse cases, the same benefit is gained for safety analysis.…”

“…afety is a critical quality attribute of software. The importance of safety leads to the rise of software safety requirements, which serve as a basis for developed software products [1]. Safety requirements are a defined basis that aims to minimize risk by making faults prediction, which may happen before launching the product [2].…”

Analyzing the Impact of Assessing Requirements Specifications on the Software Development Life Cycle

“…Project specifications should be of high quality to reduce failure of software products such as code and test cases [ 7 , 12 ]. Arogundade et al [ 15 ] examined and identified concepts that constitute a modeling technique for the safety risk assessment of the Information System (IS) and developed a conceptual model for the achievement of the safety risk assessment of the IS during the requirement analysis phase of the software process.…”

Analyzing Safety of Collaborative Cyber-Physical Systems Considering Variability

“…This information can be supplemented to other hazard analysis techniques to find the potential effects of that particular failure on the system and also to find potential safety guards to ensure the safety of the system. The extracted information from v_FTG can also be used to revise the safety requirements of a collaborative CPS [28].…”