Quantitative risk-based requirements reasoning

Feather, Martin S.; Cornford, Steven L.

doi:10.1007/s00766-002-0160-y

Cited by 68 publications

(53 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In the identify-assess-control cycles of risk analysis at requirements engineering time [8,13,14,17,20], most of the work so far has been devoted to risk identification and assessment. For risk identification, scenario-based heuristics are available [2,29] as well as goal-oriented formal techniques [1,14].…”

Section: Related Workmentioning

confidence: 99%

“…For risk identification, scenario-based heuristics are available [2,29] as well as goal-oriented formal techniques [1,14]. For risk assessment, various kinds of quantitative techniques are available [3,5,8,25]. For risk control, the only work on countermeasure exploration is [14] where the obstacle resolution tactics mentioned in this paper are described.…”

Section: Related Workmentioning

confidence: 99%

“…They often arise from a natural inclination to believe that the software and its environment will always behave as expected; no requirements are engineered for cases where this optimistic assumption does not hold. Requirements completeness therefore calls for putting risk analysis at the heart of the RE process [2,3,5,8,13,14,20].…”

Section: Introductionmentioning

confidence: 99%

“…A risk is an uncertain factor whose occurrence may result in the loss of satisfaction of some high-level objective [4,8,13]. A risk has a probability of occurrence and one or multiple consequences.…”

Section: Introductionmentioning

confidence: 99%

“…A risk has a probability of occurrence and one or multiple consequences. Each consequence has a severity in degree of loss of satisfaction of the corresponding objective [5,8]. Risks may cover undesirable situations such as safety hazards [16,18], security threats [12,26] or data inaccuracies [14] dependent on the type of objective they negatively impact on.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Integrating exception handling in goal models

Cailliau

Lamsweerde

2014

2014 IEEE 22nd International Requirements Engineering Conference (RE)

View full text Add to dashboard Cite

Missing requirements are known to be among the major sources of software failure. Incompleteness often results from poor anticipation of what could go wrong with an over-ideal system. Obstacle analysis is a model-based, goalanchored form of risk analysis aimed at identifying, assessing and resolving exceptional conditions that may obstruct the behavioral goals of the target system. The obstacle resolution step is obviously crucial as it should result in more adequate and more complete requirements. In contrast with obstacle identification and assessment, however, this step has little support beyond a palette of resolution operators encoding tactics for producing isolated countermeasures to single risks. In particular, there is no single clue to date as to where and how such countermeasures should be integrated within a more robust goal model. To address this problem, the paper describes a systematic technique for integrating obstacle resolutions as countermeasure goals into goal mod... Obstacle analysis is a model-based, goal-anchored form of risk analysis aimed at identifying, assessing and resolving exceptional conditions that may obstruct the behavioral goals of the target system. The obstacle resolution step is obviously crucial as it should result in more adequate and more complete requirements. In contrast with obstacle identification and assessment, however, this step has little support beyond a palette of resolution operators encoding tactics for producing isolated countermeasures to single risks. In particular, there is no single clue to date as to where and how such countermeasures should be integrated within a more robust goal model. To address this problem, the paper describes a systematic technique for integrating obstacle resolutions as countermeasure goals into goal models. The technique is shown to guarantee progress towards a complete goal model; it preserves the correctness of refinements in the overall model; and keeps the original, ideal model visible to avoid cluttering the latter with a combinatorial blow-up of exceptional cases. To allow for this, the goal specification language is slightly extended in order to capture exceptions to goals seperately and distinguish normal situations from exceptional ones. The proposed technique is evaluated on a non-trivial ambulance dispatching system.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Integrating exception handling in goal models

Cailliau

Lamsweerde

2014

2014 IEEE 22nd International Requirements Engineering Conference (RE)

View full text Add to dashboard Cite

show abstract

System Design and Analysis Methods

Tumer

2011

System Health Management

View full text Add to dashboard Cite

4.3.1 Security Engineering: Systems Engineering of Security through the Adaptation and Application of Risk Management

Gilliam

Feather

2004

INCOSE International Symp

Self Cite

View full text Add to dashboard Cite

Information Technology (IT) Security Risk Management is a critical task in the organization, which must protect its resources and data against the loss of confidentiality, integrity, and availability. As systems become more complex and diverse, and more vulnerabilities are discovered while attacks from intrusions and malicious content increase, it is becoming increasingly difficult to manage IT security. This paper describes an approach to address IT security risk through risk management and mitigation in both the institution and in the project life cycle. The application of risk management to security engineering is described. Support for this through application of a security risk algorithm and a risk management tool for risk analysis is also discussed.

show abstract

Quantitative risk-based requirements reasoning

Cited by 68 publications

References 19 publications

Integrating exception handling in goal models

Integrating exception handling in goal models

System Design and Analysis Methods

4.3.1 Security Engineering: Systems Engineering of Security through the Adaptation and Application of Risk Management

Contact Info

Product

Resources

About