D.3.3 ALGORITHMS FOR INCREMENTAL ... - SecureChange

CModel. The postcondtion checks the asset in the CORAS model CModel that is
mapped to the service Asset protected by the soft goal SecGoal. The action presents
Services as a potential treatment for asset Asset.
g t r u l e t r a n s f o r m T r e a t m e n t ( o u t Treatment , o u t ReqModel , o u t
TraceModel ) ={
p r e c o n d i t i o n p a t t e r n unmappedTreatment ( Treatment , A s s e t )
={
f i n d harmedAsset ( Treatment , T h r e a t S c e n a r i o , A s s e t ) ;
neg f i n d mappedElement ( Treatment , TraceModel , Source ,
T a r g e t ) ;
}
}
p o s t c o n d i t i o n p a t t e r n newTask ( Asset , Task , ReqModel ,
TraceModel ) ={
f i n d s i s t a r m o d e l ( ReqModel ) ;
f i n d t a s k ( Task ) ;
f i n d mappedSecGoal ( Asset , SecGoal ) ;
f i n d meansEnd (R , Task , TaskName , SecGoal ,
SecGoalName ) ;
}
a c t i o n {
c a l l copyName ( Treatment , Task ) ;
c a l l c r e a t e L i n k ( Treatment , Task , TraceModel ) ;
}
Listing 1.3. Mapping Treatment to Task fulfilling a Soft Goal
The transformTreatment rule has three parameters: Treatment, the treatment to be
mapped, ReqModel, the SI* model, and TraceModel, the traceability model. The
precondition specifies two constraints for Treatment: harmedAsset identifies the
asset Asset that is harmed by the threat scenario ThreatScenario treated by
Treatment; the negative condition pattern mappedElement checks that Treatment
has not already been mapped to a task in the SI * model. The postcondtion creates a
task Task in the SI* model ReqModel and links it by means of a means-end relation
to the soft goal SecGoal that protects the service mapped to Asset. The action of the
rule names the asset Task created in ReqModel as the treatment Treatment and
creates a traceability link in the traceability model who has as source element of the
mapping Treatment and as target Task.
4 Change-driven interplay between risk and requirement analysts
The interaction between the risk analyst and requirement analyst is triggered when a
change is applied to model elements that are instances of the mapped concepts in SI*
and CORAS conceptual models. In the following we present three bidirectional propagation
scenarios where changes are propagated from the requirement models to the risk
model and vice versa. These are examples of possible scenarios that are supported by
the conceptual mappings.