Compliance analysis requires legal counsel but is generally unavailable in many software projects. Analysis of legal text using logic-based models can help developers understand requirements for the development and use of software-intensive systems throughout its lifecycle. We outline a practical modeling process for norms in legally binding agreements that include contractual rights and obligations. A computational norm model analyzes available rights and required duties based on the satisfiability of situations, a state of affairs, in a given scenario. Our method enables modular norm model extraction, representation, and reasoning. For norm extraction, using the theory of frame semantics, we construct two foundational norm templates for linguistic guidance. These templates correspond to Hohfeld’s concepts of claim-right and its jural correlative, duty. Each template instantiation results in a norm model, encapsulated in a modular unit which we call a super-situation that corresponds to an atomic fragment of law. For hierarchical modularity, super-situations contain a primary norm that participates in relationships with other norm models. Norm compliance values are logically derived from its related situations and propagated to the norm’s containing super-situation, which in turn participates in other super-situations. This modularity allows on-demand incremental modeling and reasoning using simpler model primitives than previous approaches. While we demonstrate the usefulness of our norm models through empirical studies with contractual statements in open source software and privacy domains, its grounding in theories of law and linguistics allows wide applicability.

The article “Modular norm models: practical representation and analysis of contractual rights and obligations.

As the organizational use of open source software (OSS) increases, it requires the adjustment of organizational routines to manage new OSS risk. These routines may be influenced by community-developed open data standards to explicate, analyze, and report OSS risks. Open data standards are co-created in open communities for unifying the exchange of information. The SPDX® specification is such an open data standard to explicate and share OSS risk information. The development and subsequent adoption of SPDX raises the questions of how organizations make sense of SPDX when improving their own risk management routines, and of how a community benefits from the experiential knowledge that is contributed back by organizational adopters. To explore these questions, we conducted a single case, multi-component field study, connecting with members of organizations that employed SPDX. The results of this study contribute to understanding the development and adoption of open data standards within open source environments.

Cyberspace has increasingly become a medium to express outrage, conduct protests, take revenge, spread opinions, and stir up issues. Many cyber attacks can be linked to current and historic events in the social, political, economic, and cultural (SPEC) dimensions of human conflicts in the physical world. These SPEC factors are often the root cause of many cyber attacks. Understanding the relationships between past and current SPEC events and cyber attacks can help understand and better prepare people for impending cyber attacks. The focus of this paper is to analyse these attacks in social dimensions and build a threat model based on past and current social events. A reasoning technique based on a novel combination of formal concept analysis (FCA) and hierarchical fact-proposition space (FPS) inference is applied to build the model.

While the software development community has put a significant effort to capture the artifacts related to a discovered vulnerability in organized repositories, much of this information is not amenable to meaningful analysis and requires a deep and manual inspection. In the software assurance community a body of knowledge that provides an enumeration of common weaknesses has been developed, but it is not readily usable for the study of vulnerabilities in specific projects and user environments. We propose organizing the information in project repositories around semantic templates. In this paper, we present preliminary results of an experiment conducted to evaluate the effectiveness of using semantic templates as an aid to studying software vulnerabilities.

Security breaches most often occur due to a cascading effect of failure among security constraints that collectively contribute to overall secure system behavior in a socio-technical environment. Therefore, during security certification activities, analysts must systematically take into account the nexus of causal chains that exist among security constraints imposed by regulatory requirements. Numerous regulatory requirements specified in natural language documents or listed in spreadsheets/databases do not facilitate such analysis. The work presented in this article outlines a stepwise methodology to discover and understand the multidimensional correlations among regulatory requirements for the purpose of understanding the potential for risk due to noncompliance during system operation. Our lattice algebraic computational model helps estimate the collective adequacy of diverse security constraints imposed by regulatory requirements and their interdependencies with each other in a bounded scenario of investigation. Abstractions and visual metaphors combine human intuition with metrics available from the methodology to improve the understanding of risk based on the level of compliance with regulatory requirements. In addition, a problem domain ontology that classifies and categorizes regulatory requirements from multiple dimensions of a socio-technical environment promotes a common understanding among stakeholders during certification and accreditation activities. A preliminary empirical investigation of our theoretical propositions has been conducted in the domain of The United States Department of Defense Information Technology Security Certification and Accreditation Process (DITSCAP). This work contributes a novel approach to understand the level of compliance with regulatory requirements in terms of the potential for risk during system operation.

Services as abstractions of functionality have enabled the engineering of systems that support well-defined processes with relative ease. This success leads to aspirations for achieving greater complexity with the service-oriented paradigm. In particular, we address the case where the process definition is tailored differently in each instantiation based on negotiations among stakeholders of a socio-technical context. For such cases the process definition invariably crosscuts the architecture of a process-support system that composes available services. However, use of pre-defined process variations may bias the tailoring effort and thus, act against the original motivation of having a flexible definition. On the other hand, the characteristics of process complexity and tailorability introduce differences between stakeholder understanding of the process activities and their manifestation in tool support. We encounter these issues while developing a service-oriented process-support system for a security Certification and Accreditation (C&A) process. In this paper, we present our approach to effectively separate the C&A process definition from the architecture of its process-support system. We employ ontological modeling techniques to explicitly model the process definition and later expose it as a service to provide weaving rules for dynamically composing the process-support system architecture at runtime. The feasibility of our approach has been demonstrated in the design of a service-oriented architecture for a prototype workbench that supports the Department of Defense Certification and Accreditation Process (DITSCAP).

In this paper we outline our approach to discover and understand multi-dimensional correlations among regulatory security certification requirements in the context of a complex software system. A thorough understanding of these correlations is necessary to assure that diverse constraints imposed by numerous certification requirements are adequate for collectively contributing to emergent security properties in a highly interconnected socio-technical environment. We elaborate on methodological support to discover an exhaustive set of applicable certification requirements in a given operational scenario of the target software system. We then describe techniques to systematically understand the multi-dimensional correlations among these requirements with application to security risk assessment. The case study of applying our approach to a regulatory certification process of The United States Department of Defense (DoD) is presented.

Numerous interdependent quality requirements imposed by regulatory Certification and Accreditation (C&A) processes enable a rich context to gather compliance evidences for promoting software assurance. The goal of the r-AnalytiCA workbench is to make sense out of the large collection of available evidences for a complex software system though multidimensional requirements-driven problem domain analysis. The requirements analytics employed in the workbench support C&A activities by leveraging the expressiveness of ontologies used to model C&A requirements and their interdependencies.

The process of engineering software-intensive systems that comply with their Certification and Accreditation (C&A) requirements involves many critical decision-making activities for the related stakeholders. Considering the exhaustive nature of C&A activities together with the complexity of software-intensive systems, effective decision making relies heavily on the ways to understand and structure the problem domain concepts concerning decision points for interpretation, applicability, scope, evaluation, and impact of the enforced C&A requirements. These decision points are further complicated by natural language specifications of inherently non-functional C&A requirements scattered across multiple regulatory documents with complex interdependencies at different levels of abstractions in the organizational hierarchy, which often result in subjective interpretations and non-standard implementations of the C&A process. To address these issues, we define a systematic methodology using novel techniques from software Requirements Engineering (RE) and knowledge engineering for understanding and structuring the problem domain concepts based on a uniform representation format that promotes common understanding among stakeholders. Specifically, we use advanced ontological engineering techniques driven by theoretical RE foundations to systematically elicit, model, understand, and analyze problem domain concepts concerning significant and difficult decision points throughout the C&A process. We demonstrate the appropriateness of our methodology in creating decision support problem domain ontology using several examples derived from our experiences on automating the Department of Defense Information Technology Security C&A Process (DITSCAP).

Software-intensive systems are systems of systems that rely on complex interdependencies among themselves as well as with their operational environment to satisfy the required behavior. As we integrate such systems to create information infrastructures that are critical to the quality of our lives and the businesses they support, the need to effectively predict, control and evolve their behavior is ever increasing. To deal with their complexity, an important first step is to understand and model software-intensive systems, their environments and the interdependencies among them at different levels of abstractions from multiple dimensions. In this paper, we present an ontology-based active requirements engineering (Onto-ActRE) framework that adopts a mixed-initiative approach to elicit, represent and analyze the diversity of factors associated with software-intensive systems. The Onto-ActRE framework integrates various RE modeling techniques with complementary semantics in a unifying ontological engineering process. We also present examples from the practice of our framework with appropriate tool support that combines theoretical and practical aspects.

Collaboration systems require an appropriate authorization model to specify and maintain policies that not only facilitate group activities but also enforce restrictions and accountability. Existing models fail to incorporate adequately into authorization decisions the rich notion of context that is inherent to any collaborative setting. In this paper we present the locale-based access control (locale-BAC) model for collaborative systems, a model whose design is based upon the application of Fitzpatrick's locale framework for collaboration to the problem of access control. This model encapsulates the notion of context using locales, allowing for a natural representation of collaborative authorization decisions.