Designing Secure and Privacy-Aware Information Systems

Designing Secure and Privacy-Aware Information Systems

Christos Kalloniatis (Department of Cultural Technology and Communication, University of the Aegean, Lesvos, Greece), Argyri Pattakou (Department of Cultural Technology and Communication, University of the Aegean, Lesvos, Greece), Evangelia Kavakli (Department of Cultural Technology and Communication, University of the Aegean, Lesvos, Greece) and Stefanos Gritzalis (Department of Information and Communication Systems Engineering, University of the Aegean, Samos, Greece)
DOI: 10.4018/978-1-5225-7113-1.ch022
OnDemand PDF Download:
No Current Special Offers


Pervasiveness of information systems is well underway, redefining our social and economic relationships. This technological revolution has generated enormous capabilities, but also enabled the creation of new vulnerabilities and threats. A major challenge in the field of information systems is therefore, to ensure the trustworthiness of the underlying technologies that make possible the generation, collection, storage, processing and transmission of user data at rates more intensive than ever before. Trust in information systems depends on different aspects, one of which is the security of user's data. Data security is referred as the protection of user's data from corruption and unauthorized access. Another important aspect of trust is the protection of user's privacy. Protecting privacy is about complying with user's desires when it comes to handling personal information. Without security to guarantee data protection, appropriate uses of that data cannot be realized. This implies that security and privacy issues are inherently intertwined and should be viewed synergistically. The aim of this paper is to elevate modern practices for ensuring security and privacy during software systems analysis and design. To this end, the basic security and privacy requirements that should be considered are introduced. Additionally, a number of well known methods in the research area of requirements engineering which focus on eliciting and modeling security and privacy requirements are described. Finally, a comparative analysis between these methods is presented.
Chapter Preview

2. Security And Privacy Requirements

Data security in information systems is referred to the protection of digital data from unauthorized access, processing or disclosure through the whole data life cycle. Data must be secured not only from intentional but from accidental unauthorized access too. Software engineers are responsible to design and implement software systems that are able to prevent potential attackers from unauthorized access and processing in order to ensure data security and business continuity.

Privacy relates to protecting or controlling the disclosure of personal data, i.e. any information concerning the personal or material circumstances of an identified or identifiable person (the data subject). In general, privacy protection can be undertaken by:

Complete Chapter List

Search this Book: