Grupo Alarcos · Conference paper · 2006
Security Risk Analysis in Web Services Systems
Carlos Gutiérrez García, Eduardo Fernández-Medina Patón, Mario Piattini Velthuis
Nowadays, best practices dictate that security requirements of distributed software-intensive systems should be based on security risk assessments. Web services-based systems supporting network alliances among organizations through Internet are such type of systems. In this article we present how we’ve adopted the risk analysis and management methodology of the Spanish Public Administration, which conforms to ISO 15408 Common Criteria Framework (CCF), to the Process for Web Services Security (PWSSec) developed by the authors. In addition, a real case study where this adaptation was applied is shown.