Security policy management for networked information systems

Successful management of networked information systems is largely dependent on security. However, security is a very complex task that ranges from the level of crypto-primitives over crypto-protocols to the level of organizational matters and legislation. All this is comprised in a so-called security policy, which is often treated as an afterthought. One of the main reasons is the lack of appropriate techniques for conceptual modeling of security policy at early stages of system design. The approach in this paper gives an appropriate solution that also bridges the gap to formal techniques. It results in a formalized output that serves as a basis for further refinement in subsequent stages of the modeling process.