Analyzing regulatory rules for privacy and security requirements

DMCA

Analyzing regulatory rules for privacy and security requirements (2008)

Cached

Download Links

Other Repositories/Bibliography

DBLP

by Travis D. Breaux , Student Member , Annie I. Antón , Senior Member

Venue:	IEEE Transactions on Software Engineering
Citations:	68 - 13 self

BibTeX

@ARTICLE{Breaux08analyzingregulatory,
    author = {Travis D. Breaux and Student Member and Annie I. Antón and Senior Member},
    title = {Analyzing regulatory rules for privacy and security requirements},
    journal = {IEEE Transactions on Software Engineering},
    year = {2008}
}

OpenURL

Abstract

Abstract—Information practices that use personal, financial, and health-related information are governed by US laws and regulations to prevent unauthorized use and disclosure. To ensure compliance under the law, the security and privacy requirements of relevant software systems must properly be aligned with these regulations. However, these regulations describe stakeholder rules, called rights and obligations, in complex and sometimes ambiguous legal language. These “rules ” are often precursors to software requirements that must undergo considerable refinement and analysis before they become implementable. To support the software engineering effort to derive security requirements from regulations, we present a methodology for directly extracting access rights and obligations from regulation texts. The methodology provides statement-level coverage for an entire regulatory document to consistently identify and infer six types of data access constraints, handle complex cross references, resolve ambiguities, and assign required priorities between access rights and obligations to avoid unlawful information disclosures. We present results from applying this methodology to the entire regulation text of the US Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. Index Terms—Data security and privacy, laws and regulations, compliance, accountability, requirements engineering.

Keyphrases

security requirement regulatory rule access right u health insurance portability ambiguous legal language resolve ambiguity health-related information stakeholder rule software engineering effort privacy rule regulation text abstract information practice requirement engineering entire regulatory document handle complex cross reference considerable refinement u law unlawful information disclosure index term data security unauthorized use privacy requirement present result statement-level coverage relevant software system entire regulation text data access constraint accountability act software requirement

DMCA