Modelling tool extension for vulnerability management

Conference item

Managing vulnerabilities with respect to the design of systems is essential to securing systems and establishing their trustworthiness. Until now, there has been no modelling tool to support vulnerability management within the context of system design. We present a new, open-source extension of a systems security design and assessment tool. First and foremost, this extension integrates a pertinent vulnerability management domain ontology into the tool's underlying metamodel. Based on the extended metamodel, the enriched tool supports importing information from vulnerability-related knowledge bases as well as capturing new vulnerability information and security rules. This information can then be used in an integrative and scalable form to analyse and reason about the security of systems designs. The extended tool now includes an automated reasoning mechanism for establishing the vulnerability posture of systems designs.

Authors: Shaked, A; Messe, N; Melham, T

• Publication status: Published
• Peer review status: Peer reviewed
• Publisher: Association for Computing Machinery
• Host title: MODELS Companion '24: Proceedings of the ACM/IEEE 27th International Conference on Model Driven Engineering Languages and Systems
• Pages: 56-60
• Publication date: 2024-10-31
• Acceptance date: 2024-08-07
• Event title: ACM/IEEE 27th International Conference on Model Driven Engineering Languages and Systems (MODELS 2024)
• Event location: Linz, Austria
• Event website: https://conf.researchr.org/home/models-2024
• Event start date: 2024-09-22
• Event end date: 2024-09-27
• DOI: 10.1145/3652620.3687791
• EISBN: 9798400706226
• Language: English
• Keywords: security by design; threat modelling; model driven engineering; vulnerability management