1. TRUST TRADE-OFF ANALYSIS FOR SECURITY REQUIREMENTS ENGINEERING Authors: Golnaz Elahi, PhD student at the University of Toronto, Canada Eric Yu, full professor at the University of Toronto, Canada Presenter: Bas Vlug

2. About the method Seven step agent- and goal-oriented method for analyzing security requirements 1. Identify actors and actors’ dependencies 2. Model and refine actors’ goals 3. Discover and model trust relationships in the dependency chain 4. Recording trust rationale 5. Replace the trustee party with a corresponding malicious party 6. Model and analyze vulnerabilities 7. Analyze the trust trade-offs Provides the capability to analyze potential malicious behavior of trustee parties

3. Process- Deliverable Diagram

4. Example Imagine: an organization wants to make a back-up Alternative: store back-up in the cloud!

5. Step 1: Identify actors & dependencies

6. Step 2: Model & refine goals

9. Step 3: Model trust relationships Step 4: Record trust rationale &

10. &

11. &

12. Step 5: Model malicious party

14. Step 6: Model vulnerabilities

16. Intermezzo: Create models for other alternatives! Store back-up locally? Don’t make a back-up at all?

17. Step 7: Analyze trust trade-offs

18. AlternativeGoal 1Goal 2Goal 3Goal 4Goal 5 Alternative 1PSFSPDFSPS Alternative 1 counterpart FDPDFDPD Alternative nFSPSFDFS Alternative n counterpart PD FD

19. Related literature - positioning Agent-oriented modelling notations i* Goal-oriented Requirements Language (GRL) Eric Yu’s seminal proposal Trust trade-off analysis for security requirements engineering TROPOS … (Ayala, C., Cares, C., Carvallo, J., Franch, X., Grau, G., Haya, M., Mayol, E., Quer, C., Salazar, G. (2005). A Comparative Analysis of i*-Based Agent-Oriented Modeling Languages. Proceedings of 17th International Conference on Software Engineering and Knowledge Engineering, Taipei, Taiwan, 43-50. )

20. Related literature – contribution Cited 9 times 4x self citation Used for: Even Swaps decision analysis Method that could be used when choosing an alternative from the trust trade-off table Not part of the method itself.

21. Questions?