The Security Assessment Domain: A Survey of Taxonomies and Ontologies <s> IV. RELATED WORK <s> Using journal citation reports to determine the influence and impact of a variety of journals publishing IS research. <s> BIB001 </s> The Security Assessment Domain: A Survey of Taxonomies and Ontologies <s> IV. RELATED WORK <s> To obtain evidence of the security of different products or organizations, systematic approaches to measuring security are needed. We introduce a high abstraction level taxonomy to support the development of feasible security metrics, along with a survey of the emerging security metrics from the academic, governmental and industrial perspectives. With our taxonomy, we strive to bridge the gap between information security management and ICT products, and services security engineering. We believe that if common metrics approaches between different security disciplines can be found, this will advance our holistic understanding and capabilities, both in security management and engineering. Our taxonomy is based on comparing earlier taxonomy approaches and analyzing types of security metrics. Based on the survey, a discussion of future research directions is given in order to prompt advances in the field. <s> BIB002 </s> The Security Assessment Domain: A Survey of Taxonomies and Ontologies <s> IV. RELATED WORK <s> The use of ontologies for representing knowledge provides us with organization, communication and reusability. Information security is a serious requirement which must be carefully considered. Concepts and relations managed by any scientific community need to be formally defined and ontological engineering supports their definition. In this paper, the method of systematic review is applied with the purpose of identifying, extracting and analyzing the main proposals for security ontologies. The main identified proposals are compared using a formal framework and we conclude by stating their early state of development and the need of additional research efforts. <s> BIB003 </s> The Security Assessment Domain: A Survey of Taxonomies and Ontologies <s> IV. RELATED WORK <s> Mobile devices such as laptops, PDAs and cell phones have become essential tools for enterprise productivity, but they are in fact significantly more vulnerable to attack than desktop computers. This paper provides a broad overview of threats to mobile devices and the data that resides on them, as well as available defenses. It provides a taxonomy that divides threats to mobile devices into seven categories: malware, phishing and social engineering, direct attack by hackers, data communication interception and spoofing, loss and theft of devices, malicious insider actions, and user policy violations. It then discusses security technologies that can be applied against each of these threat types, including firewalls, anti-virus and zero day anti-malware software, intrusion prevention systems, virtual private networks, data encryption, device control and data leak prevention technologies. It suggests how to assess priorities among the different threats and defenses, and concludes with suggestions for further research. <s> BIB004 </s> The Security Assessment Domain: A Survey of Taxonomies and Ontologies <s> IV. RELATED WORK <s> Unified and formal knowledge models of the information security domain are fundamental requirements for supporting and enhancing existing risk management approaches. This paper describes a security ontology which provides an ontological structure for information security domain knowledge. Besides existing best-practice guidelines such as the German IT Grundschutz Manual also concrete knowledge of the considered organization is incorporated. An evaluation conducted by an information security expert team has shown that this knowledge model can be used to support a broad range of information security risk management approaches. <s> BIB005 </s> The Security Assessment Domain: A Survey of Taxonomies and Ontologies <s> IV. RELATED WORK <s> One of the most important aspects in the achievement of secure software systems in the software development process is what is known as Security Requirements Engineering. However, very few reviews focus on this theme in a systematic, thorough and unbiased manner, that is, none of them perform a systematic review of security requirements engineering, and there is not, therefore, a sufficiently good context in which to operate. In this paper we carry out a systematic review of the existing literature concerning security requirements engineering in order to summarize the evidence regarding this issue and to provide a framework/background in which to appropriately position new research activities. <s> BIB006 </s> The Security Assessment Domain: A Survey of Taxonomies and Ontologies <s> IV. RELATED WORK <s> The evolution of information technology has facilitated the dissemination of information in the organizational and inter-organizational context. The availability of information and today’s turbulent business environment has resulted in an increased focus on information security issues. While managers realize the need to implement security guidelines, they do not have a clear understanding of what must be protected and how they might go about it. This article presents a general overview of the field of security research, describes distinct related initiatives and highlights the significance of information classification in achieving security goals in the organizational environment. We advocate that organizations can benefit by adopting ontologies as an alternative means of classifying information. The current phase of the research effort has produced results regarding the terminological stage of a domain ontology about security information. We expect to further contribute to the development of other initiatives related to this aspect of Information Science, as well as found the work of the information professionals and managers who drive security projects. <s> BIB007 </s> The Security Assessment Domain: A Survey of Taxonomies and Ontologies <s> IV. RELATED WORK <s> Normally, software development practices concentrate to take all security requirements into account at design-time. Nevertheless, today's software products are intended to be used in mobile, or alternatively, in embedded devices whose environment changes during the application's execution. These kinds of changes occur especially in applications used in smart spaces. This enforces to think security concerns more dynamically. Thus, software has to be aware of its 1) security level in each time, and 2) changes in its environment that can cause security threats. Based on this awareness, software has to change its security mechanisms to fulfil security requirements in the current context. A security measurement is a key factor of this awareness. This work presents a micro-architecture for security adaptation and taxonomy of context information affecting to information security in smart spaces. The security measurement is the essential part of the micro-architecture. In addition, taxonomy describes concepts that have to be monitored in the smart space environment. <s> BIB008 </s> The Security Assessment Domain: A Survey of Taxonomies and Ontologies <s> IV. RELATED WORK <s> The use of ontologies to represent knowledge provides us with organization, communication and reusability. The concepts and relations managed by any scientific community need to be formally defined. Since security in information technologies has evolved as a critical aspect and many related topics have been developed, this paper applies the method of systematic review for identifying, extracting and analyzing the principal proposals for security ontologies. The most mature proposals have been selected and compared by using a formal framework, extracting the key requirements that an integrated and unified security ontology should have, and providing the first steps towards its definition. <s> BIB009 </s> The Security Assessment Domain: A Survey of Taxonomies and Ontologies <s> IV. RELATED WORK <s> Abstract : An ontology captures in a computer-processable language the important concepts in a particular domain and the relationships between these concepts. Ontologies are becoming increasingly pervasive in various fields of computer and information science. They are indispensable components of many complex information systems, especially systems in which communication among heterogeneous components is critical. I use the following definition of ontology, which captures the essence of the most widely adopted definitions in the field: an ontology is a specific, formal representation of a shared conceptualisation of a domain. The IO Branch of DSTO's C3ID Division is interested in the possibility of using one or more ontologies to describe computer networks and support automated reasoning about their properties (particularly security properties). This report provides a basic overview of research and development related to ontologies and their use in information systems. The primary goal of the report is to help readers to discover topics of interest and to conduct further investigation of the literature. To this end, besides information about ontologies in general, the report also includes some specific comments about the use of ontologies to model and reason about computer networks and their security. <s> BIB010 </s> The Security Assessment Domain: A Survey of Taxonomies and Ontologies <s> IV. RELATED WORK <s> Intelligent sensors experience security problems very similar to those inherent to other kinds of IT products or systems. The assurance for these products or systems creation methodologies, like Common Criteria (ISO/IEC 15408) can be used to improve the robustness of the sensor systems in high risk environments. The paper presents the background and results of the previous research on patterns-based security specifications and introduces a new ontological approach. The elaborated ontology and knowledge base were validated on the IT security development process dealing with the sensor example. The contribution of the paper concerns the application of the knowledge engineering methodology to the previously developed Common Criteria compliant and pattern-based method for intelligent sensor security development. The issue presented in the paper has a broader significance in terms that it can solve information security problems in many application domains. <s> BIB011 </s> The Security Assessment Domain: A Survey of Taxonomies and Ontologies <s> IV. RELATED WORK <s> Despite existing methodologies in the field, most requirements engineers are poorly trained to define security requirements. This is due to a considerable lack of security knowledge. Some security ontologies have been proposed, but a gap still exists between the two fields of security requirement engineering and ontologies. This paper is a survey, it proposes an analysis and a typology of existing security ontologies and their use for requirements definition. <s> BIB012 </s> The Security Assessment Domain: A Survey of Taxonomies and Ontologies <s> IV. RELATED WORK <s> paper, we introduce a knowledge-oriented approach for the Security Requirements Engineering phase for developing E-Voting System. The knowledge acquired through the process of eliciting and analyzing secure E-Voting System is represented in the form of UML models; which can be made available to future developers and the dependency towards security experts can be reduced. In this paper we present a set of security requirements and security requirements patterns that were developed based on the aforementioned approach. Security requirements for modelling have been identified by following the Model Oriented Security Requirements Engineering framework for web applications. The security requirements have been designed into security requirements patterns for creating security requirements ontology for an E- Voting System. The ontology allows all concepts of importance and their relationships to be identified. The paper also compares the approach with other relevant methods in the Security Requirements Engineering phase for developing secure applications. <s> BIB013 </s> The Security Assessment Domain: A Survey of Taxonomies and Ontologies <s> IV. RELATED WORK <s> The Internet of Services (IoS) has become the dominant paradigm for building applications in an ad-hoc, dynamic fashion by composing services from a variety of different providers. While the business value of the IoS is undoubted, security and trustworthiness concerns still constitute an obstacle for uptake. In this paper we argue that security certification is a valid means to address these issues. However, existing certification schemes addressing static systems and environments do not scale to the IoS and, thus, cannot be straightforwardly adapted. We investigate into the reasons for the lack of scale and conclude that three areas need to be addressed: explicit representation, machine readability, and advanced composition support. For each of these areas, we sketch solutions and identify further challenges. <s> BIB014 </s> The Security Assessment Domain: A Survey of Taxonomies and Ontologies <s> IV. RELATED WORK <s> Software systems are often certified to guarantee they satisfy particular functional or non-functional requirements, including safety, security or privacy. In this paper, we propose an approach based on the use of ontologies to support the description of the content of security certificates for services. The work frames in the scope of the ASSERT4SOA project, which investigates the way to dynamically search for services satisfying certain security requirements. The ASSERT4SOA Ontology, the main result of this work, supports the interoperability and comparison of heterogeneous certificates and the run-time verification of the compliance of services with the security requirements asserted in their certificates. <s> BIB015 </s> The Security Assessment Domain: A Survey of Taxonomies and Ontologies <s> IV. RELATED WORK <s> Asset information obtained via infrastructure analysis is essential for developing and establishing risk management. However, information about assets acquired by existing infrastructure analysis processes is often incomplete or lacking in detail, especially concerning their interconnected topology. In this paper, we present the Interconnected-asset Ontology, IO, as a step towards a standardized representation of detailed asset information. The utilization of an asset ontology as a machine-readable representation supports the automation of risk management processes and the standardization of asset information reduces redundant acquisition processes that are often found in practice. <s> BIB016 </s> The Security Assessment Domain: A Survey of Taxonomies and Ontologies <s> IV. RELATED WORK <s> Information Security Management has been contemporarily confronted by standards covering business aspects related to Information Technology. Different standards map the problem of information security to a set of controls that represent safeguards for different security vulnerabilities. Several procedure-oriented maturity models have been proposed for managing the progress on information security, however, few approaches use quantitative techniques for analyzing the progress on information security. In this paper we propose that the problem of becoming security compliance can be analyzed as a problem of multi-paths where checking different controls means choosing different ways of reaching a security compliance. We identify a set of concepts from security ontologies in order to identify a set of variables influencing these paths. The main contribution is formulating the problem of reaching some standard compliance in the shape of optimization problems, thus existing optimization techniques can be applicable. <s> BIB017 </s> The Security Assessment Domain: A Survey of Taxonomies and Ontologies <s> IV. RELATED WORK <s> Nowadays information systems play a vital role for organizations and individuals, which is why their protection is becoming increasingly important. Often, solutions are developed for very similar problems over and over again. An exchange of knowledge between experts would be desirable in order to prevent developing always the same solutions by independent persons. Such an exchange could also lead to solutions of higher quality, as existing approaches could be advanced, instead of always reinventing the security wheel. This paper examines how machine-readable information security knowledge can be shared between different organizations on the basis of a web portal utilizing Web-Prot\'{e}g\'{e}. It can be shown that through the use of ontologies the domain of information security can be modeled and stored in a human- and a machine-readable format, enabling both human editing and automation (e.g. for risk calculations). The evaluation of the web portal has shown that the most important challenge a tool for knowledge sharing has to face is the aspect of motivating users to participate in a knowledge exchange. <s> BIB018 </s> The Security Assessment Domain: A Survey of Taxonomies and Ontologies <s> IV. RELATED WORK <s> Adoption of security standards has the capability of improving the secu- rity level in an organization as well as to provide additional benefits and possibilities to the organization. However mapping of used standards has to be done when more than one security standard is employed in order to prevent redundant activities, not optimal resource management and unnecessary outlays. Employment of security on- tology to map different standards can reduce the mapping complexity however the choice of security ontology is of high importance and there are no analyses on security ontology suitability for adaptive standards mapping. In this paper we analyze existing security ontologies by comparing their general prop- erties, OntoMetric factors and ability to cover different security standards. As none of the analysed security ontologies were able to cover more than 1/3 of security stan- dards, we proposed a new security ontology, which increased coverage of security standards compared to the existing ontologies and has a better branching and depth properties for ontology visualization purposes. During this research we mapped 4 security standards (ISO 27001, PCI DSS, ISSA 5173 and NISTIR 7621) to the new security ontology, therefore this ontology and mapping data can be used for adaptive mapping of any set of these security standards to optimize usage of multiple security standards in an organization. <s> BIB019
In this section, we analyse works that present a survey as the main contribution (MC-SY). After evaluating and classifying the works, we highlight the works by Blanco BIB003 , BIB009 , Mellado BIB006 and Souag BIB012 , as they all present characteristics expected of a good quality literature review (CR-REV, CR-MET, CR-SUM, CR-DOM, CR-VIS, CR-QLT). BIB012 present an analysis of existing security ontologies and their use in defining requirements. The work is part of a project that aims to improve the definition of security requirements using ontologies. This study addresses the question: which security ontology is suitable for my needs? Ontologies are classified into eight families, by extending previous works. The authors analyzed how each ontology covers each aspect of security (e.g., Goals, assets, vulnerabilities, threats, and countermeasures). The literature review was adapted from BIB001 BIB001 and   . The authors have also used BIB003 BIB003 ,   and BIB010 BIB010 Concerning the ontologies (MC-OY), we can identify that among recent works (2011-2015) most are still RI-FMK. However, we can identify works that address other research issues, namely: RI-REQ  , BIB013 , BIB014 , BIB011 ; RI-AUD BIB019 , BIB015 , BIB016 , BIB017 ; RI-KMN  , BIB018 ,  , BIB007 . We can see gaps in the literature. There is a lack of works that address the following RIs: RI-RUS, RI-APR, RI-CAS RI-SSI, RI-DST, RI-IDV, RI-MET, RI-PTA, RI-AVS. This finding indicates that these RIs can be addressed in future papers, increasing the likelihood of original contributions. Concerning AD, there is a good distribution among the domains in recent works. Most of the least recent works (up to 2009) are: AD-GER and AD-KMN. On the other hand, AD-REG, AD-DPR, AD-IOT and AD-MOB are not found in recent works (from 2011 on). Regarding taxonomies (MC-TY), most of the RIs is RI-FMK, with the exception of BIB008 (RI-ERS), BIB004 (RI-MNT) and BIB002 (RI-MET). There were not works addressing the following ADs: AD-EHE, AD-AUD, AD-EVT, AD-SOA, AD-EGV, and AD-REG. This finding indicates that studies applied in these ADs can be addressed in future works, increasing the likelihood of original contributions. Recent works address a wide variety of application domains (AD). This finding could indicate that attempts to describe newer and smaller research fields may be a feasible alternative  ,  , BIB005 . In Appendices I, II and III we present comparative tables of the papers related to ontologies and taxonomies.