| Security, privacy, and trustworthiness are among the most important quality attributes of software-based systems that determine their overall success. The mechanisms that implement these requirements often make use of low-level rules to constrain runtime behavior. Ideally, these low-level rules should derive from enterprise-level constraints imposed by corporate policies, industry standards, best-practices, laws and regulations. Alternatively, they can derive from real threats to the system. Quite often however, implemented rules (or mechanisms) can neither be systematically traced to the enterprise-level constraints that necessitate them, nor to the real threats and vulnerabilities that they are intended to mitigate. As a result, low-level rules are often implemented in an ad-hoc manner, which gives room for potentials policy errors such as conflicts and inconsistencies. Moreover, there is lack of established techniques or tools for ensuring this kind of traceability. In this thesis, we present SePTRA, a policy-based framework for eliciting, specifying, and analyzing security, privacy, and trustworthiness requirements for software-based systems. Specifically, the framework enables the construction of a strategic policy configuration from goal, threat and other domain models of a given software system, in a traceable manner that is also consistency preserving. This configuration consists of a domain description and a collection of strategic, tactical and operational policies. The framework also defines a taxonomy of policy errors, and a process for systematically refining abstract policies into more formal models that in turn enable the prevention and detection of these errors. Another benefit is that the visual artifacts produced while using the framework can be used to communicate about security, privacy, and trustworthiness, among analysts and developers during the early phases of software development. A prototype tool support has been developed to demonstrate the feasibility of the approach. This tool enforces traceability and consistency constraints that enables the prevention of some classes of policy errors in a given policy configuration. The utility of the approach is also illustrated by applying it in three experimental studies drawn from different application domains. |
