Law and the software development life cycle November 25, 2017 - - PowerPoint PPT Presentation

▶

Dec 22, 2023 179 likes •708 views

Law and the software development life cycle November 25, 2017 Cesare Bartolini, Gabriele Lenzini Interdisciplinary Centre for Security, Reliability and Trust (SnT), University of Luxembourg Outline 1 Legal requirements 2 The Software

SLIDE 1

Law and the software development life cycle

November 25, 2017 Cesare Bartolini, Gabriele Lenzini

Interdisciplinary Centre for Security, Reliability and Trust (SnT), University of Luxembourg

SLIDE 2

Outline

1 Legal requirements 2 The Software Development Life Cycle 3 Legal requirements in the Software Development Life Cycle (SDLC) 4 Putting it all together

Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 1 / 33

SLIDE 3

Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 2 / 33

SLIDE 4

L

AT

EX

Outline

1 Legal requirements 2 The Software Development Life Cycle 3 Legal requirements in the SDLC 4 Putting it all together

Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 2 / 33

SLIDE 5

Requirements in software

◮ Functional

◮ What the system must do

◮ Non functional

◮ How the system must do it Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 3 / 33

SLIDE 6

Requirements in software

◮ Functional

◮ What the system must do

◮ Non functional

◮ How the system must do it

Typical non functional requirements

◮ Performance (good quality software) ◮ Security (confidentiality of information) ◮ Efficiency (limited use of resources) ◮ Cost-effectiveness (competitiveness on the market) ◮ Usability (easy to use for its target customers) ◮ . . .

Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 3 / 33

SLIDE 7

Requirements in software

◮ Functional

◮ What the system must do

◮ Non functional

◮ How the system must do it

Typical non functional requirements

◮ Performance (good quality software) ◮ Security (confidentiality of information) ◮ Efficiency (limited use of resources) ◮ Cost-effectiveness (competitiveness on the market) ◮ Usability (easy to use for its target customers) ◮ . . . ◮ Compliance with legal obligations

Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 3 / 33

SLIDE 8

Ratio of legal requirements

◮ Laws set rules for enterprises

◮ Obligations / prohibitions / permissions Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 4 / 33

SLIDE 9

Ratio of legal requirements

◮ Laws set rules for enterprises

◮ Obligations / prohibitions / permissions

◮ Already happened in the past

◮ Products (health, transparency, competition. . . ) ◮ Industrial processes (safety, environment. . . )

◮ Now happening in the digital world

Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 4 / 33

SLIDE 10

Ratio of legal requirements

◮ Laws set rules for enterprises

◮ Obligations / prohibitions / permissions

◮ Already happened in the past

◮ Products (health, transparency, competition. . . ) ◮ Industrial processes (safety, environment. . . )

◮ Now happening in the digital world ◮ Growing number of digital policies

◮ Especially in the European Union Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 4 / 33

SLIDE 11

Purposes

◮ Corporates

◮ Security for trade secrets ◮ E-commerce ◮ Intellectual property

◮ Users

◮ Data protection ◮ Privacy

◮ Public safety

◮ Cybersecurity ◮ Data and news reliability ◮ Social trust Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 5 / 33

SLIDE 12

Purposes (2)

◮ Crime control

◮ Backdoors ◮ Access to authorities ◮ Notice and take down

◮ National security

◮ Export control ◮ Security in military / intelligence software Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 6 / 33

SLIDE 13

Legal sources

◮ Law

◮ HIPAA ◮ E-commerce Directive ◮ General Data Protection Regulation (GDPR) ◮ Export control (ITAR) ◮ . . .

◮ Policies / standards

◮ Security standards ◮ Sectorial standards

◮ Contracts

◮ Service-Level Agreements (SLAs) Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 7 / 33

SLIDE 14

Standards and laws

Policies / standards may be mandated

◮ PCI DSS (payment cards) in Nevada & Washington ◮ A variant of ISO 13485 (medical devices) in Mexico ◮ . . .

Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 8 / 33

SLIDE 15

Standards and laws

Policies / standards may be mandated

◮ PCI DSS (payment cards) in Nevada & Washington ◮ A variant of ISO 13485 (medical devices) in Mexico ◮ . . .

Problems

Mandatory standards can introduce limitations to competitivity due to stringent requirements that may limit the target market.

Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 8 / 33

SLIDE 16

Two types of requirements

Organizational

◮ Concerns the structure of the enterprise or the business processes ◮ May introduce specific roles ◮ May introduce specific activities ◮ May introduce specific timings ◮ May depend on enterprise size and type

Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 9 / 33

SLIDE 17

Two types of requirements

Organizational

◮ Concerns the structure of the enterprise or the business processes ◮ May introduce specific roles ◮ May introduce specific activities ◮ May introduce specific timings ◮ May depend on enterprise size and type

Technical

◮ Concerns specific activities to be put into place ◮ Depend on the technical state of the art

◮ By means of a relatio

◮ May or may not evolve in time

◮ Formal or substantive relatio

◮ May exclude from damage liability ◮ May be integrated into the SDLC

Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 9 / 33

SLIDE 18

Outline

1 Legal requirements 2 The Software Development Life Cycle 3 Legal requirements in the SDLC 4 Putting it all together

Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 10 / 33

SLIDE 19

SDLC concept

Figure: Stages of the SDLC.

Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 11 / 33

SLIDE 20

SDLC structures

Figure: The waterfall model.

Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 12 / 33

SLIDE 21

SDLC structures (2)

Figure: The V-model.

Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 13 / 33

SLIDE 22

SDLC structures (3)

Figure: The spiral model.

Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 14 / 33

SLIDE 23

Dealing with requirements

◮ Formal definition ◮ Representation (model) ◮ Implementation (measures) ◮ Assessment (metrics) ◮ Monitoring

Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 15 / 33

SLIDE 24

Outline

1 Legal requirements 2 The Software Development Life Cycle 3 Legal requirements in the SDLC 4 Putting it all together

Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 16 / 33

SLIDE 25

One objective, many solutions

◮ SDLC extension with legal requirements can happen in many ways ◮ Different methodologies for each SDLC stage ◮ Also depend on the software engineering approaches used ◮ Just a few guidelines

Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 17 / 33

SLIDE 26

Definition

◮ Definition written in legal language

◮ Especially when the source is the law ◮ Standards and contracts may give an easier time

◮ Many possible technical definitions

◮ Only partial overlap between legal and technical definitions

◮ Definition must be interpreted

◮ May differ depending on interpretation Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 18 / 33

SLIDE 27

Definition

◮ Definition written in legal language

◮ Especially when the source is the law ◮ Standards and contracts may give an easier time

◮ Many possible technical definitions

◮ Only partial overlap between legal and technical definitions

◮ Definition must be interpreted

◮ May differ depending on interpretation

Examples

Service, cloud, database, file, request. . .

Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 18 / 33

SLIDE 28

More than words

◮ Affects all of the following stages

◮ Model ◮ Implementation ◮ Metrics

◮ Taken from literature or ad hoc ◮ May require feedback from later stages. . .

◮ . . . if it proves too problematic to use ◮ . . . if the scope is too broad or too narrow ◮ . . . if it is not useful enough Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 19 / 33

SLIDE 29

Formal definition

Natural language Ontologies

Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 20 / 33

SLIDE 30

Ontologies

◮ Knowledge representation ◮ Descriptions of a knowledge domain ◮ Language used: Web Ontology Language (OWL)

◮ (Sic)

◮ Representation of real-world objects ◮ They do not define anything

◮ Objects are defined in the domain itself

◮ They describe relations

Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 21 / 33

SLIDE 31

A parliament of OWLs

◮ Ontologies can be extended with deontic rules

◮ must ◮ should not ◮ may ◮ . . .

◮ Legal ontologies ◮ These can describe duties etc.

Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 22 / 33

SLIDE 32

A parliament of OWLs

◮ Ontologies can be extended with deontic rules

◮ must ◮ should not ◮ may ◮ . . .

◮ Legal ontologies ◮ These can describe duties etc. ◮ They can be used to describe legal requirements

Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 22 / 33

SLIDE 33

Representation

◮ Describes the requirement in formal terms ◮ Various degrees of detail ◮ Can include a destructuring ◮ Can include relationship with other requirements ◮ Should include metrics for evaluation ◮ Should connect to the design tools and models

Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 23 / 33

SLIDE 34

Formal models

◮ Unified Modeling Language (UML)

◮ Easy to connect with design tools

◮ i*

◮ Highlights roles of stakeholders

◮ Goal model

◮ Hierarchical representation

◮ 4-variable model

◮ Strong connection between actual data and software

◮ . . .

Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 24 / 33

SLIDE 35

Implementation

◮ The requirement must be implemented into the software ◮ Implementation differs depending on many factors

◮ Development tools ◮ Programming language ◮ Content of requirement ◮ Nature of requirement ◮ Functionality ◮ Performance ◮ Restriction ◮ . . . Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 25 / 33

SLIDE 36

Sample implementations

Right of access to personal data

◮ Requires a module that grants access

◮ Front-end interface ◮ Authentication method ◮ Data base and query engine Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 26 / 33

SLIDE 37

Sample implementations

Right of access to personal data

◮ Requires a module that grants access

◮ Front-end interface ◮ Authentication method ◮ Data base and query engine

Encryption protocol for secure payments

◮ Needs a component to process encrypted data

◮ Encrypting module ◮ Decryping module Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 26 / 33

SLIDE 38

Sample implementations

Right of access to personal data

◮ Requires a module that grants access

◮ Front-end interface ◮ Authentication method ◮ Data base and query engine

Encryption protocol for secure payments

◮ Needs a component to process encrypted data

◮ Encrypting module ◮ Decryping module

Export control under ITAR regulations

◮ Access must be denied to non-citizens

◮ Database of citizenships ◮ Access limitations Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 26 / 33

SLIDE 39

Assessment

Compliance

◮ For every requirement in the specification ◮ Depending on its nature

◮ Qualitative (e.g., the functionality is present / not present) ◮ Quantitative (e.g., measure of the security strength)

◮ At different levels

◮ Component ◮ Integration Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 27 / 33

SLIDE 40

Assessment

Compliance

◮ For every requirement in the specification ◮ Depending on its nature

◮ Qualitative (e.g., the functionality is present / not present) ◮ Quantitative (e.g., measure of the security strength)

◮ At different levels

◮ Component ◮ Integration

◮ Metrics must be implemented

Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 27 / 33

SLIDE 41

Assessment

Compliance

◮ For every requirement in the specification ◮ Depending on its nature

◮ Qualitative (e.g., the functionality is present / not present) ◮ Quantitative (e.g., measure of the security strength)

◮ At different levels

◮ Component ◮ Integration

◮ Metrics must be implemented ◮ At least for quantitative assessments

Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 27 / 33

SLIDE 42

Work in progress

Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 28 / 33

SLIDE 43

Examples

Reliability

◮ System must backup data in three different locations

◮ Backup delay ◮ Backup time ◮ Security of transfer Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 29 / 33

SLIDE 44

Examples

Reliability

◮ System must backup data in three different locations

◮ Backup delay ◮ Backup time ◮ Security of transfer

Transparency

◮ System must provide information in a clear and intelligible form

◮ Usability of the interface ◮ Detailedness of the information ◮ Clarity of the language used Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 29 / 33

SLIDE 45

Monitoring

◮ Things change over time (e.g., functionality, hardware, laws)

Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 30 / 33

SLIDE 46

Monitoring

◮ Things change over time (e.g., functionality, hardware, laws) ◮ And sometimes they just don’t work as they appear on paper

Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 30 / 33

SLIDE 47

Monitoring

◮ Things change over time (e.g., functionality, hardware, laws) ◮ And sometimes they just don’t work as they appear on paper ◮ And sometimes a periodic check is mandated

Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 30 / 33

SLIDE 48

Monitoring

◮ Things change over time (e.g., functionality, hardware, laws) ◮ And sometimes they just don’t work as they appear on paper ◮ And sometimes a periodic check is mandated ◮ Evaluate compliance over time ◮ Implementation of monitoring tools ◮ Halfway between implementation and testing ◮ Reports

Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 30 / 33

SLIDE 49

Outline

1 Legal requirements 2 The Software Development Life Cycle 3 Legal requirements in the SDLC 4 Putting it all together

Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 31 / 33

SLIDE 50

The three-eyed researcher

Three different perspectives

◮ Analysis and formalization of legal requirements ◮ Modelling legal requirements and defining metrics ◮ Integrating legal requirements in all stages of the SDLC

Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 32 / 33

SLIDE 51

How to achieve it

◮ Currently only some ad hoc solutions for specific requirements ◮ More standardized approach to legal requirements ◮ Techniques to model interpretation ◮ Classification of legal requirements ◮ Extending SDLC methodologies and tools

Cesare Bartolini, Gabriele Lenzini (SnT)Law and the software development life cycle November 25, 2017 33 / 33