Digital transformation is a hot topic in the current global environment as a large number of organizations have been working to adopt digital solutions. Software engineering has also emerged to be a more important role as a large number of systems, either traditional or smart, are dependent on the software that collects, store, and process data. The role of software engineers has also become crucial in digital transformation. In this regard, this paper aims to examine the trends of software engineering and the role of software engineers in digital transformation. In addition to this, this paper also examines the importance of secure software development in digital transformation. It can be concluded that software engineering is an integral part of digital transformation as all digital systems make use of software to perform their functions efficiently. Software act as a bridge between digital systems and humans to use the systems interactively and efficiently.
The present volume contains the proceedings of the Fourth International Workshop on Engineering Safety and Security Systems (ESSS'15). The workshop was held in Oslo, Norway, on June 22nd, 2015, as a satellite event of the 20th International Symposium on Formal Methods (FM'15).
Digitization not only affects society, it also requires a redefinition of the location of computer science and computer scientists, as the science journalist Yogeshwar suggests. Since all official aspects of digitalization are based on software, this article is intended to attempt to redefine the role of software engineering and its research. Software-based products, systems or services are influencing all areas of life and are a critical component and central innovation driver of digitization in all areas of life. Scientifically, there are new opportunities and challenges for software enginee…
Integrating security into agile software development is an open issue for research and practice. Especially in strongly regulated industries, complexity increases not only when scaling agile practices but also when aiming for compliance with security standards. To achieve security compliance in a large-scale agile context, we developed S2C-SAFe: An extension of the Scaled Agile Framework that is compliant to the security standard IEC~62443-4-1 for secure product development. In this paper, we present the framework and its evaluation by agile and security experts within Siemens' large-scale pro…
This paper presents a systematic mapping study on the model-driven engineering of safety and security concerns in systems. Integrated modeling and development of both safety and security concerns is an emerging field of research. Our mapping study provides an overview of the current state-of-the-art in this field. Through a rigorous and systematic process, this study carefully selected 95 publications out of 17,927 relevant papers published between 1992 and 2018. This paper then proposes and answers several relevant research questions about frequently used methods, development stages where the…
Today's software engineering already needs to deal with challenges originating from the multidisciplinarity that is required to realize IoT products: Many variants consist of sensor/actuator-powered systems that already today use AI/ML systems to better cope with the unstructuredness of their intended operational design domain (ODD), while, at the same time, such systems need to be monitored, diagnosed, maintained, and evolved using cloud-powered dashboards and data analytics pipelines that process, aggregate, and analyze countless data points preferably in real-time. This position paper discu…
The International Workshop on Engineering Safety and Security Systems (ESSS) aims at contributing to the challenge of constructing reliable and secure systems. The workshop covers areas such as formal specification, type checking, model checking, program analysis/transformation, model-based testing and model-driven software construction. The workshop will bring together researchers and industry R&D expertise together to exchange their knowledge, discuss their research findings, and explore potential collaborations. The main theme of the workshop is methods and techniques for constructing large…
As we are continuously depending on information technology applications by adopting electronic channels and software applications for our business, online transaction and communication, software security is increasingly becoming a necessity and more advanced concern. Both the functional and non-functional requirements are important and provide the necessary needs at the early phases of the software development process, specifically in the requirement phase. The aim of this research is to identify security threats early in the software development process to help the requirement engineer elicit…
Security engineering in the software lifecycle aims at protecting information and systems to guarantee confidentiality, integrity, and availability. As security engineering matures and the number of research papers grows, there is an increasing need for papers that summarize results and provide an overview of the area. A systematic mapping study "maps" a research area by classifying papers to identify which topics are well-studied and which need additional study. Therefore, systematic mapping studies are becoming increasingly important in security engineering. This chapter provides methodologi…
Secure software engineering is a fundamental activity in modern software development. However, while the field of security research has been advancing quite fast, in practice, there is still a vast knowledge gap between the security experts and the software development teams. After all, we cannot expect developers and other software practitioners to be security experts. Understanding how software development teams incorporate security in their processes and the challenges they face is a step towards reducing this gap. In this paper, we study how financial services companies ensure the security…
[Background] The rapidly changing business environments in which many companies operate is challenging traditional Requirements Engineering (RE) approaches. This gave rise to agile approaches for RE. Security, at the same time, is an essential non-functional requirement that still tends to be difficult to address in agile development contexts. Given the fuzzy notion of "agile" in context of RE and the difficulties of appropriately handling security requirements, the overall understanding of how to handle security requirements in agile RE is still vague. [Objective] Our goal is to characterize …
A Digital Twin (DT) is a digital representation of a physical object used to simulate it before it is built or to predict failures after the object is deployed. In this article, we introduce our approach, which applies the concept of a Cyber Digital Twin (CDT) to automotive software for the purpose of security analysis. In our approach, automotive firmware is transformed into a CDT, which contains automatically extracted, security-relevant information from the firmware. Based on the CDT, we evaluate security requirements through automated analysis and requirements verification using policy enf…
A digital forensic investigation aims to collect and analyse the evidence necessary to demonstrate a potential hypothesis of a digital crime. Despite the availability of several digital forensics tools, investigators still approach each crime case from scratch, postulating potential hypotheses and analysing large volumes of data. This paper proposes to explicitly model forensic requirements in order to engineer software systems that are forensic-ready and guide the activities of a digital investigation. Forensic requirements relate some speculative hypotheses of a crime to the evidence that sh…
In this paper, we show a security engineering process based on a formal notion of refinement fully formalized in the proof assistant Isabelle. This Refinement-Risk Cycle focuses on attack analysis and security refinement supported by interactive theorem proving. Since we use a fully formalized model of infrastructures with actors and policies we can support a novel way of formal security refinement for system specifications. This formal process is built practically as an extension to the Isabelle Infrastructure framework with attack trees. We define a formal notion of refinement on infrastruct…
A Java File Security System (JFSS) [1] has been developed by us. That is an ecrypted file system. It is developed by us because there are so many file data breaches in the past and current history and they are going to increase day by day as the reports by DataLossDB (Open Security Foundation) organization, a non-profit organization in US so it is. The JFSS is evaluated regarding the two software engineering approaches. One of them is size metric that is Lines of Code (LOC) in the software product development. Another approach is the customer oriented namely User Satisfaction Testing methodolo…
An Exemplar of a Digital Twin in Mechanical Engineering: Understanding Model Hybridization
Centre Inria d’Université Côte d’Azur（法国南部高地大学Inria中心）；Université de Rennes/Inria/Irisa, team DiverSE（雷恩大学/Inria/Irisa，DiverSE团队）；Université Côte d’Azur/I3S/Inria, team Kairos（法国南部高地大学/I3S/Inria，Kairos团队）
By exploiting the increasing surface attack of systems, cyber-attacks can cause catastrophic events, such as, remotely disable safety mechanisms. This means that in order to avoid hazards, safety and security need to be integrated, exchanging information, such as, key hazards/threats, risk evaluations, mechanisms used. This white paper describes some steps towards this integration by using models. We start by identifying some key technical challenges. Then we demonstrate how models, such as Goal Structured Notation (GSN) for safety and Attack Defense Trees (ADT) for security, can address these…
Deep Learning (DL) techniques are now widespread and being integrated into many important systems. Their classification and recognition abilities ensure their relevance for multiple application domains. As machine-learning that relies on training instead of algorithm programming, they offer a high degree of productivity. But they can be vulnerable to attacks and the verification of their correctness is only just emerging as a scientific and engineering possibility. This paper is a major update of a previously-published survey, attempting to cover all recent publications in this area. It also c…
We introduce SysML-Sec, a SysML-based Model-Driven Engineering environment aimed at fostering the collaboration between system designers and security experts at all methodological stages of the development of an embedded system. A central issue in the design of an embedded system is the definition of the hardware/software partitioning of the architecture of the system, which should take place as early as possible. SysML-Sec aims to extend the relevance of this analysis through the integration of security requirements and threats. In particular, we propose an agile methodology whose aim is to a…
A Systematic Review of Digital Twin-Driven Predictive Maintenance in Industrial Engineering: Taxonomy, Architectural Elements, and Future Research Directions
Intelligent Distributed Computing and Systems (INDUCE) Lab, Department of Computer Science and Software Engineering, College of Information Technology, United Arab Emirates University, Al-Ain, United Arab Emirates, Emirates Center for Mobility Research, United Arab Emirates University, Al-Ain, United Arab Emirates（智能分布式计算与系统实验室，计算机科学与软件工程系，信息科技学院，阿联酋大学，阿恩，阿联酋，移动性研究中心，阿联酋大学，阿恩，阿联酋）；Department of Architectural Engineering, College of Engineering, United Arab Emirates University, Al-Ain, United Arab Emirates（建筑工程系，工程学院，阿联酋大学，阿恩，阿联酋）；Department of Information Systems and Security, College of Information Technology, United Arab Emirates University, Al-Ain, United Arab Emirates（信息系统与安全系，信息科技学院，阿联酋大学，阿恩，阿联酋）；Department of Computer and Network Engineering, United Arab Emirates University, Al-Ain, United Arab Emirates（计算机与网络工程系，阿联酋大学，阿恩，阿联酋）
On AI Safety and Security Technical Debt in Engineering AI-Enabled Systems
University of Birmingham（伯明翰大学）；HBKU（哈马德·本·哈利法大学）；Bournemouth University（伯恩茅斯大学）；Brunel University London（伦敦布鲁内尔大学）；University of Hawaii（夏威夷大学）；College of Science and Engineering, HBKU（哈马德·本·哈利法大学科学与工程学院）
