Search

Cyber attacks targeting software applications have a tremendous impact on our daily life. For example, attackers have utilized vulnerabilities of web applications to steal and gain unauthorized use of sensitive data stored in these systems. Previous studies indicate that security testing is highly precise, and therefore is widely applied to validate individual security requirements. However, dependencies between security requirements may cause additional vulnerabilities. Manual dependency detection faces scalability challenges, e.g., a previous study shows that the pairwise dependency analysis of 40 requirements would take around 12 hours. In this paper, we present a novel approach which integrates the interdependency among high-level security requirements, such as those documented in policies, regulations, and standards. We then use automated requirements tracing methods to identify product-level security requirements and their dependencies. Our manual analysis of HIPAA and FIPS 200 leads to the identification of five types of high-level security requirements dependencies, which further inform the automated tracing methods and guide the designs of system-level security tests. Experimental results on five projects in healthcare and education domains show the significant recall improvements at 81%. Our case study on a deployed production system uncovers four previously unknown vulnerabilities by using the detected requirements dependencies as test paths, demonstrating our approach's value in connecting requirements engineering with security testing.

QUOKKA is a 40 m pinhole small-angle neutron scattering instrument in routine user operation at the OPAL research reactor at the Australian Nuclear Science and Technology Organisation. Operating with a neutron velocity selector enabling variable wavelength, QUOKKA has an adjustable collimation system providing source–sample distances of up to 20 m. Following the large-area sample position, a two-dimensional 1 m2 position-sensitive detector measures neutrons scattered from the sample over a secondary flight path of up to 20 m. Also offering incident beam polarization and analysis capability as well as lens focusing optics, QUOKKA has been designed as a general purpose SANS instrument to conduct research across a broad range of scientific disciplines, from structural biology to magnetism. As it has recently generated its first 100 publications through serving the needs of the domestic and international user communities, it is timely to detail a description of its as-built design, performance and operation as well as its scientific highlights. Scientific examples presented here reflect the Australian context, as do the industrial applications, many combined with innovative and unique sample environments.