Today computer systems are becoming very complex and often depending on some off-the-shelf components or external service providers. Validating the security aspects of these systems is a highly challenging goal, especially when we target security critical systems where guarantees must be provided on the robustness of the produced systems. Model Driven Engineering (MDE) is becoming popular and well accepted in both academia and critical systems industry. In our work, we aim to propose a novel MDE compliant security validation methodology based on architecture model based testing. In this paper, we focus on security modeling for improving the testability of the architecture models and facilitating the evaluation of the proposed test generation and selection methods. More specifically, we are interested in extending the SAE standard AADL [1] to improve the quality of the security test cases generated from AADL models.

Security and domain specific regulations are critical for any organization. Unfortunately, achieving these prerequisites in a socio-technical environment is a difficult task. For example, let us consider the aspect of computer security: neither software developers nor regulatory authorities are security experts. Therefore, it is important that security experts' knowledge is captured and made available to software developers. Security patterns are a suitable prescription to capture experts' solutions to commonly recurring security problems. In this paper, we present the application of a general framework, based on security patterns, used to develop secure applications. It covers the entire process of solution development: defining organizational security requirements using SECURE TROPOS, formalizing the pattern using SI*, implementing the pattern, integrating it into the final application, and monitoring the runtime. All these phases are discussed and illustrated with an eBusiness case study: the loan origination process.

In our own previous work [1], we looked at the problem of designing IT solutions ( Security Patterns) accounting for legal and organizational issues. The proposed pattern de- sign and validation process require legal experts to describe patterns in natural language. Such a description is parsed by a natural language processor on the basis of a semantic template [2]. The annotated description is then used to automatically generate graphical models of SI* patterns, which are revised by security engineers using a CASE Tool 1. The intriguing question that we address in this paper is the opposite of the mainstream one: Challenge 1. You have a technical solution (e.g. a se- curity and dependability pattern). Can some of your system requirements be implemented by legal means? This challenge might seem at odd with intuition but only because we don't bring the usage of patterns to their logi- cal end: if an answer to a legal, organizational or technical security requirement can be an organizati...

Nowadays, more and more information systems are connected to the Internet and offer Web interfaces to the general public or to a restricted set of users. Such openness makes them likely targets for intruders, and conventional protection techniques have been shown insufficient to prevent all intrusions in such open systems. This paper proposes a generic architecture to implement intrusion-tolerant Web servers. This architecture is based on redundancy and diversification principles in order to increase the system resilience to attacks: usually, an attack targets a particular software, running on a particular platform, and fails on others. The architecture is composed of redundant proxies that mediate client requests to a redundant bank of diversified application servers. The redundancy is deployed here to increase system availability and integrity. To improve performance, adaptive redundancy is applied: the redundancy level is selected according to the current alert level. The architecture can be used for static servers, that is, for Web distribution of stable information (updated offline) and for fully dynamic systems where information updates are executed immediately on an online database. The feasibility of this architecture has been demonstrated by implementing an example of a travel agency Web server, and the first performance tests are satisfactory, both for request execution times and recovery after incidents.

This paper presents a measurement-based dependability study using event logs collected during about 3 years from 133 Windows NT and 2K workstations and servers interconnected through a LAN. We focus on the identification of machine reboots, the classification of of their causes, and the evaluation of statistics characterizing the uptimes, downtimes, and the availability of the Windows NT and 2K machines.