Supporting Agile Development of Authorization Rules for SME Applications
Custom SME applications for collaboration and workflow have become affordable when implemented as Web applications employing Agile methodologies. Security engineering is still difficult with Agile development, though: heavy-weight processes put the improvements of Agile development at risk. We propose Agile security engineering and increased end-user involvement to improve Agile development with respect to authorization policy development. To support the authorization policy development, we introduce a simple and readable authorization rules language implemented in a Ruby on Rails authorization plugin that is employed in a real-world SME collaboration and workflow application. Also, we report on early findings of the language’s use in authorization policy development with domain experts.
KeywordsAuthorization Policy Agile Security Engineering End-User Development DSL SME Applications
Unable to display preview. Download preview PDF.
- 1.ISO/IEC 27001:2005. Information technology – Security techniques – Information security management systems – Requirements. ISO, Geneva, SwitzerlandGoogle Scholar
- 2.ANSI INCITS 359-2004. Role-Based Access Control. American Nat’l Standard for Information Technology (2004)Google Scholar
- 6.Church, L.: End user security: The democratisation of security usability. In: Security and Human Behaviour (2008)Google Scholar
- 8.Dai, J., Alves-Foss, J.: Logic based authorization policy engineering. In: The 6th World Multiconference on Systemics, Cybernetics and Informatics (2002)Google Scholar
- 9.Ferraiolo, D., Kuhn, R.: Role-based access controls. In: 15th NIST-NCSC National Computer Security Conference, pp. 554–563 (1992)Google Scholar
- 13.McDermott, J., Fox, C.: Using abuse case models for security requirements analysis. In: ACSAC 1999: Proceedings of the 15th Annual Computer Security Applications Conference, Washington, DC, USA, p. 55. IEEE Computer Society, Los Alamitos (1999)Google Scholar
- 17.Tappenden, A., Beatty, P., Miller, J.: Agile security testing of web-based systems via httpunit. In: AGILE, pp. 29–38. IEEE Computer Society Press, Los Alamitos (2005)Google Scholar
- 18.Thomas, R.K., Sandhu, R.S.: Thomas and Ravi S. Sandhu. Task-based authorization controls (TBAC): A family of models for active and enterprise-oriented autorization management. In: Proceedings of the IFIP TC11 WG11.3 Eleventh International Conference on Database Securty XI, London, UK, pp. 166–181. Chapman & Hall, Ltd., Boca Raton (1998)Google Scholar