Integrating security design into the software development process for e‐commerce systems

Abstract

Development of Web‐based e‐commerce systems has posed challenges in different dimensions of the software development process including design, maintenance and performance. Non‐functional requirements such as performance added to the system as an after thought would lead to extremely high cost and undesirable effects. Security, rarely regarded in the past as one of the non‐functional requirements, has to be integrated into the software development process due to its impact on e‐commerce systems. In this paper, a design methodology based on systems security engineering capability maturity model (SSE‐CMM) is proposed to specify design details for the three defined processes: risk, engineering and assurance. By means of an object‐oriented security design pattern, security design covering impact, threats, risks and countermeasures for different parts of an e‐commerce system can be examined systematically in the risk process. The proposed software development process for secured systems (SDPSS), representing the engineering process, consists of four steps: object and collaboration modeling, tier identification, component identification and deployment specification. Selected unified modeling language notations and diagrams are used to support the SDPSS. Using a simplified supply‐chain e‐commerce system as an example, integration of security design into the software development process is shown with discussions of possible security assurance activities that can be performed on a design.

An aspect-based approach to modeling access control concerns

“…see Refs. [1,2,11,20,23,28,37,39,40,47,64,65]). These works use the UML extension mechanisms to introduce representations of dependability concerns in UML models.…”

Designing High Integrity Systems Using Aspects

“…There has been some work on using the UML to model security concerns (e.g., see [1,2,6,9,12,15,17,18,19,22,30,32]). Chan and Kwok [6] model a design pattern for security that addresses asset and functional distribution, vulnerability, threat, and impact of loss.…”

“…Chan and Kwok [6] model a design pattern for security that addresses asset and functional distribution, vulnerability, threat, and impact of loss. UML stereotypes identify classes that have particular security needs due to their vulnerability either as assets or as a result of functional distribution.…”

Usability of Security Specification Approaches for UML Design: A Survey.

“…Chan and Kwok [5] propose a design methodology for e-commerce systems to specify design details for three processes: Risk, Engineering, and Assurance, which 6 JOURNAL OF OBJECT TECHNOLOGY VOL 0, NO. 0 [20] SecureUML [17] Zisman [30] SOCLe [19] For-LySa [18] Epstein and Sandhu [7] Brose et al [4] Ahn and Shin [1] AuthUML [2] represent the main areas of security engineering in the systems security engineering capability maturity model (SSE-CMM) on which this methodology is based.…”

“…Many contributions have been presented in the state of the art for specifying and enforcing security at UML design [1,2,4,5,6,7,8,14,16,17,18,19,20,22,23,27,28,30]. While sharing almost the same objectives, these contributions Cite this document as follows: http://www.jot.fm/general/JOT template LaTeX.tgz * The research leading to this work was possible due to funding and scientific collaboration with Software Research, Ericsson Canada.…”