Contextualisation of Data Flow Diagrams for Security Analysis
Paper in proceedings, 2020
Data flow diagrams (DFDs) are popular for sketching systems for subsequent threat modelling. Their limited semantics make reasoning about them difficult, but enriching them endangers their simplicity and subsequent ease of take up. We present an approach for reasoning about tainted data flows in design-level DFDs by putting them in context with other complementary usability and requirements models. We illustrate our approach using a pilot study, where tainted data flows were identified without any augmentations to either the DFD or its complementary models.
Author
Shamal Faily
Bournemouth University
Riccardo Scandariato
Chalmers, Computer Science and Engineering (Chalmers), Software Engineering (Chalmers), Software Engineering for Cyber Physical Systems
Adam Shostack
Shostack and Associates
Laurens Sion
KU Leuven
Duncan Ki-Aries
Bournemouth University
Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
03029743 (ISSN) 16113349 (eISSN)
Vol. 12419 LNCS 186-197
7th International Workshop on Graphical Models for Security, GramSec 2020
Boston, USA,
Boston, USA,
Subject Categories
Embedded Systems
Computer Science
Computer Systems
DOI
10.1007/978-3-030-62230-5_10