Invited talk: A framework to support alignment of secure software engineering with legal regulations
Author: Dr. Shareeful Islam, Dr. Haralambos Mouratidis and Prof. Dr. Jan Jürjens
Abstract
Regulation compliance is getting more and more important for software systems that process and manage sensitive information. Therefore, identifying and analysing relevant legal regulations and aligning them with security requirements become necessary for the effective development of secure software systems. Nevertheless, Secure Software Engineering Modelling Languages (SSEML) use different concepts and terminology from those used in the legal domain for the description of legal regulations. This situation, together with the lack of appropriate background and knowledge of laws and regulations, introduces a challenge for software developers to elicit security requirements from the relevant laws and regulations and to trace the elicited requirements throughout the development stages. Our work contributes to develop a framework that supports the consideration of laws and regulations during the development of secure software systems. The proposed framework enables software developers (i) to correctly elicit security requirements from the appropriate laws and regulations; and (ii) to trace these requirements throughout the development stages in order to ensure that the design indeed supports the required laws and regulations. Our framework is based on existing work from the area of secure software engineering, and it complements this work with a novel and structured process and a well-defined method.
Short Bio
Dr. Shareeful Islam was awarded his PhD in Software Risk Management Model using goal-driven approach from chair of Software & Systems Engineering (I4), Technische Universität München, Germany. He has received M.Sc. degree in Information Communication System Security(ICSS) from the Royal Institute of Technology, Sweden. He also received M.Sc. degree in Computer Science (CS)and B. Sc. (Hon’s) in applied physics and electronics (APE) from the University of Dhaka, Bangladesh. He completed the ISO 9001:2001 lead auditor certification and is a certified quality management system auditor. He has more than 10 publication in well recognized journals. His main research interests are in the field of software risk management, software security and privacy. Special interests are risk management model, security and privacy, requirements engineering and modelling.