A Survey of Security Assessment Ontologies <s> Discussion and Related Work <s> Using journal citation reports to determine the influence and impact of a variety of journals publishing IS research. <s> BIB001 </s> A Survey of Security Assessment Ontologies <s> Discussion and Related Work <s> The evolution of information technology has facilitated the dissemination of information in the organizational and inter-organizational context. The availability of information and today’s turbulent business environment has resulted in an increased focus on information security issues. While managers realize the need to implement security guidelines, they do not have a clear understanding of what must be protected and how they might go about it. This article presents a general overview of the field of security research, describes distinct related initiatives and highlights the significance of information classification in achieving security goals in the organizational environment. We advocate that organizations can benefit by adopting ontologies as an alternative means of classifying information. The current phase of the research effort has produced results regarding the terminological stage of a domain ontology about security information. We expect to further contribute to the development of other initiatives related to this aspect of Information Science, as well as found the work of the information professionals and managers who drive security projects. <s> BIB002 </s> A Survey of Security Assessment Ontologies <s> Discussion and Related Work <s> Intelligent sensors experience security problems very similar to those inherent to other kinds of IT products or systems. The assurance for these products or systems creation methodologies, like Common Criteria (ISO/IEC 15408) can be used to improve the robustness of the sensor systems in high risk environments. The paper presents the background and results of the previous research on patterns-based security specifications and introduces a new ontological approach. The elaborated ontology and knowledge base were validated on the IT security development process dealing with the sensor example. The contribution of the paper concerns the application of the knowledge engineering methodology to the previously developed Common Criteria compliant and pattern-based method for intelligent sensor security development. The issue presented in the paper has a broader significance in terms that it can solve information security problems in many application domains. <s> BIB003 </s> A Survey of Security Assessment Ontologies <s> Discussion and Related Work <s> The use of ontologies to represent knowledge provides us with organization, communication and reusability. The concepts and relations managed by any scientific community need to be formally defined. Since security in information technologies has evolved as a critical aspect and many related topics have been developed, this paper applies the method of systematic review for identifying, extracting and analyzing the principal proposals for security ontologies. The most mature proposals have been selected and compared by using a formal framework, extracting the key requirements that an integrated and unified security ontology should have, and providing the first steps towards its definition. <s> BIB004 </s> A Survey of Security Assessment Ontologies <s> Discussion and Related Work <s> paper, we introduce a knowledge-oriented approach for the Security Requirements Engineering phase for developing E-Voting System. The knowledge acquired through the process of eliciting and analyzing secure E-Voting System is represented in the form of UML models; which can be made available to future developers and the dependency towards security experts can be reduced. In this paper we present a set of security requirements and security requirements patterns that were developed based on the aforementioned approach. Security requirements for modelling have been identified by following the Model Oriented Security Requirements Engineering framework for web applications. The security requirements have been designed into security requirements patterns for creating security requirements ontology for an E- Voting System. The ontology allows all concepts of importance and their relationships to be identified. The paper also compares the approach with other relevant methods in the Security Requirements Engineering phase for developing secure applications. <s> BIB005 </s> A Survey of Security Assessment Ontologies <s> Discussion and Related Work <s> The Internet of Services (IoS) has become the dominant paradigm for building applications in an ad-hoc, dynamic fashion by composing services from a variety of different providers. While the business value of the IoS is undoubted, security and trustworthiness concerns still constitute an obstacle for uptake. In this paper we argue that security certification is a valid means to address these issues. However, existing certification schemes addressing static systems and environments do not scale to the IoS and, thus, cannot be straightforwardly adapted. We investigate into the reasons for the lack of scale and conclude that three areas need to be addressed: explicit representation, machine readability, and advanced composition support. For each of these areas, we sketch solutions and identify further challenges. <s> BIB006 </s> A Survey of Security Assessment Ontologies <s> Discussion and Related Work <s> Software systems are often certified to guarantee they satisfy particular functional or non-functional requirements, including safety, security or privacy. In this paper, we propose an approach based on the use of ontologies to support the description of the content of security certificates for services. The work frames in the scope of the ASSERT4SOA project, which investigates the way to dynamically search for services satisfying certain security requirements. The ASSERT4SOA Ontology, the main result of this work, supports the interoperability and comparison of heterogeneous certificates and the run-time verification of the compliance of services with the security requirements asserted in their certificates. <s> BIB007 </s> A Survey of Security Assessment Ontologies <s> Discussion and Related Work <s> Asset information obtained via infrastructure analysis is essential for developing and establishing risk management. However, information about assets acquired by existing infrastructure analysis processes is often incomplete or lacking in detail, especially concerning their interconnected topology. In this paper, we present the Interconnected-asset Ontology, IO, as a step towards a standardized representation of detailed asset information. The utilization of an asset ontology as a machine-readable representation supports the automation of risk management processes and the standardization of asset information reduces redundant acquisition processes that are often found in practice. <s> BIB008 </s> A Survey of Security Assessment Ontologies <s> Discussion and Related Work <s> Information Security Management has been contemporarily confronted by standards covering business aspects related to Information Technology. Different standards map the problem of information security to a set of controls that represent safeguards for different security vulnerabilities. Several procedure-oriented maturity models have been proposed for managing the progress on information security, however, few approaches use quantitative techniques for analyzing the progress on information security. In this paper we propose that the problem of becoming security compliance can be analyzed as a problem of multi-paths where checking different controls means choosing different ways of reaching a security compliance. We identify a set of concepts from security ontologies in order to identify a set of variables influencing these paths. The main contribution is formulating the problem of reaching some standard compliance in the shape of optimization problems, thus existing optimization techniques can be applicable. <s> BIB009 </s> A Survey of Security Assessment Ontologies <s> Discussion and Related Work <s> Nowadays information systems play a vital role for organizations and individuals, which is why their protection is becoming increasingly important. Often, solutions are developed for very similar problems over and over again. An exchange of knowledge between experts would be desirable in order to prevent developing always the same solutions by independent persons. Such an exchange could also lead to solutions of higher quality, as existing approaches could be advanced, instead of always reinventing the security wheel. This paper examines how machine-readable information security knowledge can be shared between different organizations on the basis of a web portal utilizing Web-Prot\'{e}g\'{e}. It can be shown that through the use of ontologies the domain of information security can be modeled and stored in a human- and a machine-readable format, enabling both human editing and automation (e.g. for risk calculations). The evaluation of the web portal has shown that the most important challenge a tool for knowledge sharing has to face is the aspect of motivating users to participate in a knowledge exchange. <s> BIB010 </s> A Survey of Security Assessment Ontologies <s> Discussion and Related Work <s> Despite existing methodologies in the field, most requirements engineers are poorly trained to define security requirements. This is due to a considerable lack of security knowledge. Some security ontologies have been proposed, but a gap still exists between the two fields of security requirement engineering and ontologies. This paper is a survey, it proposes an analysis and a typology of existing security ontologies and their use for requirements definition. <s> BIB011 </s> A Survey of Security Assessment Ontologies <s> Discussion and Related Work <s> Adoption of security standards has the capability of improving the secu- rity level in an organization as well as to provide additional benefits and possibilities to the organization. However mapping of used standards has to be done when more than one security standard is employed in order to prevent redundant activities, not optimal resource management and unnecessary outlays. Employment of security on- tology to map different standards can reduce the mapping complexity however the choice of security ontology is of high importance and there are no analyses on security ontology suitability for adaptive standards mapping. In this paper we analyze existing security ontologies by comparing their general prop- erties, OntoMetric factors and ability to cover different security standards. As none of the analysed security ontologies were able to cover more than 1/3 of security stan- dards, we proposed a new security ontology, which increased coverage of security standards compared to the existing ontologies and has a better branching and depth properties for ontology visualization purposes. During this research we mapped 4 security standards (ISO 27001, PCI DSS, ISSA 5173 and NISTIR 7621) to the new security ontology, therefore this ontology and mapping data can be used for adaptive mapping of any set of these security standards to optimize usage of multiple security standards in an organization. <s> BIB012
Most of the works address the conceptual formalization issue that was identified in 100% of the papers on ontologies up to 2008. After 2008, we can see other applications for ontologies. Concerning the ontologies, we can identify that among recent works (2011-2015) most address the conceptual formalization issue. However, we can identify works that address other research issues, namely: Requirements  , BIB005 , BIB006 , BIB003 ; Audit BIB012 , BIB007 , BIB008 , BIB009 ; Knowledge Management  , BIB010 ,  , BIB002 . Concerning Regarding related work, Blanco et al. BIB004 present a literature review and proposes a method for integrating ontologies, through qualitative analysis of more mature proposals. In BIB011 Souag et al. present an analysis of existing security ontologies and their use in defining requirements. The work is part of a project that aims to improve the definition of security requirements using ontologies. This study addresses the question: which security ontology is suitable for my needs? The literature review was adapted from Barnes BIB001 and Rainer & Miller  . Blanco et al. BIB004 and Souag et al. BIB011 emphasize the importance of previous literature reviews and point to the need of updates.