Logo des Repositoriums

Auflistung nach Autor:in "Brunner, Michael"

1 - 3 von 3
  • Konferenzbeitrag
    Integrating Microservices from an Ongoing Research Project
    (Software Engineering 2020, 2020) Mussmann, Andrea; Brunner, Michael
    QE LaB Business Services integrated features focusing on requirements engineering offered by OpenReq, an EU Horizon 2020 project, into an existing commercial software for the management of security requirements. The microservices were integrated as part of a dedicated Open Call project where participants from industry were asked to integrate novel features from OpenReq into their own tools and evaluate them. In this paper, we discuss our experiences with the Open Call format of the project as well as the issues we encountered and lessons we learned following scientifically acknowledge success factors.
  • Zeitschriftenartikel
    Security im Produkt-Lifecycle – Lästige Pflicht oder Chance?
    (Informatik-Spektrum: Vol. 39, No. 5, 2016) Breu, Ruth; Sillaber, Christian; Brunner, Michael
    Die heute übliche vernetzte Struktur von Softwareprodukten und komplexe Kunden-Anbieter-Szenarien machen eine tiefgehende Beschäftigung mit dem Thema Security im Produktkontext unumgänglich. Ausgehend von der Frage, was Sicherheitseigenschaften von anderen Anforderungen unterscheidet, stellen wir in unserem Beitrag kurz die Methoden und Techniken vor, die für die Erhebung und das Monitoring von Sicherheitseigenschaften notwendig sind. Insgesamt plädieren wir für eine enge Integration von Sicherheitsbetrachtungen in die Aktivitäten des Produktlebenszyklus und zeigen die Chancen auf, die damit für den Qualitätsmanagementprozess insgesamt verbunden sind.
  • Zeitschriftenartikel
    Towards data-driven decision support for organizational IT security audits
    (it - Information Technology: Vol. 60, No. 4, 2018) Brunner, Michael; Sillaber, Christian; Demetz, Lukas; Manhart, Markus; Breu, Ruth
    As the IT landscape of organizations increasingly needs to comply with various laws and regulations, organizations manage a plethora of security-related data and have to verify the adequacy and effectiveness of their security controls through internal and external audits. Existing Governance, Risk and Compliance (GRC) approaches provide little support for auditors or are tailored to the needs of auditors and do not fully support required management activities of the auditee. To address this gap and move towards a holistic solution, a data-driven approach is proposed. Following the design science research paradigm, a data-driven approach for audit data management and analytics that addresses organizational needs as well as requirements for audit data analytics was developed. We contribute workflow support and associated data models to support auditing and security decision making processes. The evaluation shows the viability of the proposed IT artifact and its potential to reduce costs and complexity of security management processes and IT security audits. By developing a model and associated decision support workflows for the entire IT security audit lifecycle, we present a solution for both the auditee and the auditor. This is useful to developers of GRC tools, vendors, auditors and organizational decision makers.