<p>This thesis suggests a security evaluation framework for distributed information systems, responsible for generating a system modelling technique and an evaluation method. The framework is flexible and divides the problem space into smaller, more accomplishable subtasks with the means to focus on specific problems, aspects or system scopes. The information system is modelled by dividing it into increasingly smaller parts, evaluate the separate parts and then build up the system “bottom up” by combining the components. Evaluated components are stored as reusable instances in a component library. The evaluation method is focusing on technological components and is based on the Security Functional Requirements (SFR) of the Common Criteria. The method consists of the following steps: (1) define several security values with different aspects, to get variable evaluations (2) change and establish the set of SFR to fit the thesis, (3) interpret evaluated security functions, and possibly translate them to CIA or PDR, (4) map characteristics from system components to SFR and (5) combine evaluated components into an evaluated subsystem. An ontology is used to, in a versatile and dynamic way, structure the taxonomy and relations of the system components, the security functions, the security values and the risk handling. It is also a step towards defining a common terminology for IT security.</p>

<p>This thesis suggests a set of system characteristics to be used when evaluating or analyzing the IT security of a distributed information system. Each characteristic is meant to be considered in the evaluation of relevant distributed system components. This is considered to be the first step towards finding a technique for modeling and evaluating the security of a system. The work also includes a definition of distributed information system components and a categorization of the found characteristics. The means used to identify the set of characteristics include a thorough investigation of the literature on the relevant subject, as well as a brainstorming session. Thereafter the material has been structured to form the results presented in this thesis.</p>

This thesis suggests a security evaluation framework for distributed information systems, responsible for generating a system modelling technique and an evaluation method. The framework is flexible and divides the problem space into smaller, more accomplishable subtasks with the means to focus on specific problems, aspects or system scopes. The information system is modelled by dividing it into increasingly smaller parts, evaluate the separate parts and then build up the system “bottom up” by combining the components. Evaluated components are stored as reusable instances in a component library. The evaluation method is focusing on technological components and is based on the Security Functional Requirements (SFR) of the Common Criteria. The method consists of the following steps: (1) define several security values with different aspects, to get variable evaluations (2) change and establish the set of SFR to fit the thesis, (3) interpret evaluated security functions, and possibly translate them to CIA or PDR, (4) map characteristics from system components to SFR and (5) combine evaluated components into an evaluated subsystem. An ontology is used to, in a versatile and dynamic way, structure the taxonomy and relations of the system components, the security functions, the security values and the risk handling. It is also a step towards defining a common terminology for IT security.

Efficient data integration is one of the most challenging problems in data management, interoperation and analysis. The Earth science data which are heterogeneous are collected at various geographical locations for scientific studies and operational uses. The intrinsic problem of archiving, distributing and searching such huge scientific datasets is compounded by the heterogeneity of data and queries, thus limiting scientific analysis, and generation/validation of hydrologic forecast models. The data models of hydrologic research communities such as National Weather Service (NWS), National Oceanic and Atmospheric Administration (NOAA), and US Geological Survey (USGS) are diverse and complex. A complete derivation of any useful hydrological models from data integrated from all these sources is often a time consuming process. One of the current trends of data harvesting in scientific community is towards a distributed digital library initiative. However, these approaches may not be adequate for data sources / entities who do not want to "upload" the data into a "data pool." In view of this, we present here an effective architecture to address the issues of data integration in such a diverse environment for hydrological studies. The heterogeneities in these datasets are addressed based on the autonomy of data source in terms of design, communication, association and execution using a hierarchical integration model. A metadata model is also developed for defining data as well as the data sources, thus providing a uniform view of the data for different kind of users. An implementation of the model using web based system that integrates widely varied hydrology datasets from various data sources is also being developed. / Master of Science

<p>The Heimdal Framework presented in this thesis is a step towards an unambiguous framework that reveals the objective strength and weaknesses of the security of components. It provides a way to combine different aspects affecting the security of components - such as category requirements, implemented security functionality and the environment in which it operates - in a modular way, making each module replaceable in the event that a more accurate module is developed. </p><p>The environment is assessed and quantified through a methodology presented as a part of the Heimdal Framework. The result of the evaluation is quantitative data, which can be presented with varying degrees of detail, reflecting the needs of the evaluator. </p><p>The framework is flexible and divides the problem space into smaller, more accomplishable subtasks with the means to focus on specific problems, aspects or system scopes. The evaluation method is focusing on technological components and is based on, but not limited to, the Security Functional Requirements (SFR) of the Common Criteria.</p>

This thesis suggests a set of system characteristics to be used when evaluating or analyzing the IT security of a distributed information system. Each characteristic is meant to be considered in the evaluation of relevant distributed system components. This is considered to be the first step towards finding a technique for modeling and evaluating the security of a system. The work also includes a definition of distributed information system components and a categorization of the found characteristics. The means used to identify the set of characteristics include a thorough investigation of the literature on the relevant subject, as well as a brainstorming session. Thereafter the material has been structured to form the results presented in this thesis.

The Heimdal Framework presented in this thesis is a step towards an unambiguous framework that reveals the objective strength and weaknesses of the security of components. It provides a way to combine different aspects affecting the security of components - such as category requirements, implemented security functionality and the environment in which it operates - in a modular way, making each module replaceable in the event that a more accurate module is developed. The environment is assessed and quantified through a methodology presented as a part of the Heimdal Framework. The result of the evaluation is quantitative data, which can be presented with varying degrees of detail, reflecting the needs of the evaluator. The framework is flexible and divides the problem space into smaller, more accomplishable subtasks with the means to focus on specific problems, aspects or system scopes. The evaluation method is focusing on technological components and is based on, but not limited to, the Security Functional Requirements (SFR) of the Common Criteria.

<p>У овом раду приказанa je анализа резултата истраживања,<br />постојећих техничких решења и искустава из IT индустрије у<br />појединачним и комбинованим областима: дистрибуирани<br />развој софтвера и управљање софтверским пројектима у<br />дистрибуираном окружењу, метричка заснованост управљања<br />софтверским пројектима, адатибилност у управљању агилним<br />софтверским пројектима, адаптибилни дистрибуираних<br />информациони системи.<br />Предложен је функционално-технолошки теоријски модел<br />софтверске подршке адаптибилног дистрибуираног<br />информационог система за подршку управљању реализацијом<br />софтверских пројеката. Предложени су приступи у процесу<br />развоја система у оквиру креирања модела софтверских<br />функција и концептуалног модела података. Предложени су<br />метрички модели за евалуацију артефакта у развоју софтвера у<br />области развоја информационих система, као и метрички<br />модели за процену трајања пројекта и мониторинг успеха<br />процеса у дистрибуираном развоју софтвера.<br />Описана је имплементација почетног прототипа система<br />(реализованог као web апликација www.it-project.rs), у оквиру<br />ког су реализоване основне функције система. Извршена су<br />емпиријска истраживања могућности коришћења прототипа<br />система у настави и професионалном усавршавању студената и<br />анализа резултата пробног коришћења прототипа од стране ИТ<br />кадрова уз пратеће анкетирање. Извршена је бенчмаркинг<br />анализа најчешће коришћених расположивих алата издвојених<br />анкетирањем. Извршена је анализа резултата емпиријских<br />истраживања у односу на ефикасност примене прототипа.<br />Извршена је анализа резултата примене метричких модела за<br />евалуацију артефакта развоја софтвера, мониторинг успеха<br />процеса и процену трајања пројекта у делу процеса<br />имплементације софтвера. Реализовано је унапређење<br />прототипа у односу на претходно дефинисане захтеве<br />функционално-технолошког теоријског модела система.</p> / <p>U ovom radu prikazana je analiza rezultata istraživanja,<br />postojećih tehničkih rešenja i iskustava iz IT industrije u<br />pojedinačnim i kombinovanim oblastima: distribuirani<br />razvoj softvera i upravljanje softverskim projektima u<br />distribuiranom okruženju, metrička zasnovanost upravljanja<br />softverskim projektima, adatibilnost u upravljanju agilnim<br />softverskim projektima, adaptibilni distribuiranih<br />informacioni sistemi.<br />Predložen je funkcionalno-tehnološki teorijski model<br />softverske podrške adaptibilnog distribuiranog<br />informacionog sistema za podršku upravljanju realizacijom<br />softverskih projekata. Predloženi su pristupi u procesu<br />razvoja sistema u okviru kreiranja modela softverskih<br />funkcija i konceptualnog modela podataka. Predloženi su<br />metrički modeli za evaluaciju artefakta u razvoju softvera u<br />oblasti razvoja informacionih sistema, kao i metrički<br />modeli za procenu trajanja projekta i monitoring uspeha<br />procesa u distribuiranom razvoju softvera.<br />Opisana je implementacija početnog prototipa sistema<br />(realizovanog kao web aplikacija www.it-project.rs), u okviru<br />kog su realizovane osnovne funkcije sistema. Izvršena su<br />empirijska istraživanja mogućnosti korišćenja prototipa<br />sistema u nastavi i profesionalnom usavršavanju studenata i<br />analiza rezultata probnog korišćenja prototipa od strane IT<br />kadrova uz prateće anketiranje. Izvršena je benčmarking<br />analiza najčešće korišćenih raspoloživih alata izdvojenih<br />anketiranjem. Izvršena je analiza rezultata empirijskih<br />istraživanja u odnosu na efikasnost primene prototipa.<br />Izvršena je analiza rezultata primene metričkih modela za<br />evaluaciju artefakta razvoja softvera, monitoring uspeha<br />procesa i procenu trajanja projekta u delu procesa<br />implementacije softvera. Realizovano je unapređenje<br />prototipa u odnosu na prethodno definisane zahteve<br />funkcionalno-tehnološkog teorijskog modela sistema.</p> / <p>Тhis work presents analysis of research results, existing<br />technical solutions and experiences from IT industry in<br />separate and combined fields of: distributed software<br />development, software project management in distributed<br />environment, metric-based software project management,<br />adaptability in management of agile software projects, as<br />well in the field of adaptable distributed information<br />systems.<br />Functional-technological theoretical model of software<br />support to adaptable distributed information system for<br />software projects realization has been proposed. Approaches<br />to creating software functions model and conceptual data<br />model within the process of the system development were<br />proposed. Metric models for evaluation of artefacts created<br />in software development within information system<br />development, as well as metric models for project duration<br />estimation and monitoring of process success in distributed<br />software development were proposed.<br />Implementation of initial prototype of the system<br />(developed as web application www.it-project.rs), that<br />includes basic functions, was described. Empirical research<br />on possibilities for using prototype in educational<br />environment and professional improvement of students, as<br />well as analysis of results from using the prototype by IT<br />professionals, with additional questionnaire, has been<br />conducted. Benchmarking analysis of most frequently used<br />available tools, extracted from questionnaire results, has<br />been performed. Analysis of empirical research results has<br />been performed in the context of prototype using efficiency.<br />Analysis of results in metric models application in evaluation<br />of software development artefacts, process success<br />monitoring and project duration estimation, in software<br />implementation process part, has been conducted.<br />Improvement of prototype has been implemented according<br />to requirements defined in previously proposed functionaltechnological<br />theoretical model of the system.</p>