Modeling of security requirements for decision information systems

Abstract

Data Warehouse (DW) is a decision information system that facilitates decision makers for the fulfillment of strategic decisions (decision making needs) by extracting and integrating data from heterogeneous sources. Due to sensitivity of the information to be maintained in the DW, it becomes important to capture information security goal as a quality goal of the stakeholders for their organization from early stages of DW life cycle. Various requirements engineering techniques have been proposed in the DW literature without paying much attention on security aspect. Recently, AGDI (agent-goal-decision-information) model was proposed to capture decision making needs of the stakeholders for their organization to build a DW, but security issue was not addressed. In this paper, we propose an extension to the AGDI model to capture security aspect (i.e. security goals of the stakeholders) right from the beginning of requirements modeling in order to prevent illegitimate attempts of accessing DW. The application of the proposed extension in the AGDI model has been demonstrated through a CASE study of a University.

PICM: A practical inference control model for protecting OLAP cubes

“…As a result, a number of suitable access control mechanisms have been developed to ensure that user queries pertaining to sensitive data will not be answered [2,3]. However, users can still uncover sensitive information by combining non-sensitive data with their own knowledge (e.g., external knowledge).…”