D.3.3 ALGORITHMS FOR INCREMENTAL ... - SecureChange

extensions to i* to model and analyze the vulnerabilities affecting system requirements.
Mayer et al. [24] propose a conceptual model for managing security of an information
system based on several security methods (e.g., CORAS, ISO 27001). Asnar et
al. [2] propose a concrete methodology, namely the Goal-Risk framework to analyze
and model security problems. GR frameworks captures the stakeholders’ goals, risks
that might threaten the goals, and countermeasures required to mitigate the unacceptable
the risk.
Compared to these approaches, the work presented in this paper proposes an interplay
between requirement engineering process and risk assessment process that is based
on orchestration rather than on integration of the two processes. Orchestration has has
several advantages with respect to integration. The first one is that the requirement
analyst and the risk analyst do not need to have in-depth expertise in the respective domains:
they just need to know the mapped concepts on which the orchestration is based.
Another key aspect of our approach is that the requirement and risk model are synchronized
not on the basis of a periodic review but as soon a change is applied to the models.
Thus, the orchestrated process ensures bidirectional consistency of requirement and the
risk models.
Change propagation. Chechik et al. [4] propose a model-based approach to propagate
changes between requirements and design models that utilize the relationship between
the models to automatically propagate changes. Lin et al. [17] propose capturing
requirement changes as a series of atomic changes in specifications and using algorithms
to relate changes in requirements to corresponding changes in specifications.
With respect to change management for risk, the ISO 31000 standard [13] prescribes
that change detection and identification for emerging risks should be conducted
as part of the overall risk management process, but gives no specific guidelines on how
to do this in practice. The well-known OCTAVE [1] risk assessment methodology recommends
reviewing risks and critical assets, but offers no techniques or modeling for
supporting the update of the risk assessment results. The approaches of Sherer [26] and
Lund et al. [20] provide some support for maintenance of risk assessment results in the
sense of restoring validity of risk documentation after changes, but change propagation
and change impact analysis are not explicitly supported.
Other works relevant to change propagation are the one about the generation and
maintenance of traceability links, and model-to-model transformations. Most of the
works on the maintenance of traceability matrix focus on the recovery of traceability
links between requirements and artifacts of different types e.g. code [6, 7, 14, 19], as in
many cases these links are not explicitly represented; and on methods and CASE tools
for the representation and management [5, 11, 12, 14] of traceability links.
Model-to-model transformation techniques such as VIATRA2 [29], QVT [27], and
ATLAS [3] support change propagation by means of bidirectional incremental model
synchronization.
In this paper we rely on VIATRA2 transformation framework to represent as graph
transformation rules the mappings between concepts of SI* and CORAS. VIATRA2
ensures the automatic creation of traceability links between CORAS and SI* models
and the execution of the mappings when a change affects a mapped concept.