Aligning Security and Privacy to Support the Development of Secure Information Systems

Abstract

The increasing dependency on information systems to process and manage sensitive information requires the usage of development methods that support the development of secure and private information systems. The literature provides examples of methods that focus on security and privacy individually but fail to provide evidence of information systems development methods that consider security and privacy in a unified framework. Security and privacy are very much related, in particular certain security properties and mechanisms support the achievement of privacy goals. Without a development framework to support developers to explicitly model that relationship, conflicts and vulnerabilities can be introduced to a system design that might endanger its security. In this paper, we present our work in developing a framework that supports the unified analysis of privacy and security. In particular, we present a meta-model that combines concepts from security and privacy requirements methods, such as security and privacy goals, properties, constraints, and actor and process patterns within a social context. A real case study is employed to demonstrate the applicability of our work.