Security Patterns M. Schumacher, E. Fernandez-Buglioni, D. - - PowerPoint PPT Presentation

▶
security patterns
SMART_READER_LITE
LIVE PREVIEW

Security Patterns M. Schumacher, E. Fernandez-Buglioni, D. - - PowerPoint PPT Presentation

Aug 21, 2023 210 likes •1.05k views

Security Patterns M. Schumacher, E. Fernandez-Buglioni, D. Hybertson, F. Bushmann, and P. Sommerlad, Security Patterns: Integrating Security and Systems Engineering, John Wiley and Sons Ltd., 2006 Lecture outline What is pattern? What is

slide-1
SLIDE 1

Security Patterns

  • M. Schumacher, E. Fernandez-Buglioni, D. Hybertson, F. Bushmann, and
  • P. Sommerlad, Security Patterns: Integrating Security and Systems

Engineering, John Wiley and Sons Ltd., 2006

slide-2
SLIDE 2

Lecture outline

  • What is pattern?
  • What is security pattern?
  • Security pattern landscape
  • SREBP
  • Examples of security risk-oriented patterns
  • Pattern identification and security requirements elicitation
  • Case study

410 ¡

slide-3
SLIDE 3

Lecture outline

  • What is pattern?
  • What is security pattern?
  • Security pattern landscape
  • SREBP
  • Examples of security risk-oriented patterns
  • Pattern identification and security requirements elicitation
  • Case study

411 ¡

slide-4
SLIDE 4

What is a Pattern?

A solution to a problem that arises within specific context Context – Problem – Solution

412 ¡

slide-5
SLIDE 5

How does pattern distinguish from an ordinary solution?

  • Pattern describes:

– Configuration of elements

  • Design outline
  • Code

– Set of instruction to create the configuration of elements

  • Process

– Presents high-quality proven solution – Reusability – Well expressed - initiates a dialog

413 ¡

slide-6
SLIDE 6

No Pattern is an Island

  • A pattern provides a self-contained solution for a specific

problem but they are not independent of one another

  • Refinement

– Solution proposed by a particular pattern can often be implemented with help of other patterns

  • which resolve the problem of the original problem

– Each pattern depends on the smaller patterns it contains and on the larger patterns in which it is contained

414 ¡

slide-7
SLIDE 7

Patterns are Everywhere

  • Mid 1990s - Object Oriented Design patterns

– Most widely known patterns Gang-of-Four book in 1995

  • Software architecture
  • Programming levels
  • Fundamental structure and

workflow of application domain – Health Care, Corporate Finance

  • Patterns spread in many other specific areas:

– Concurrent networked systems and programming – Server Components – Human-computer Interaction – .... Many other specific areas Security – interesting area

415 ¡

slide-8
SLIDE 8

Lecture outline

  • What is pattern?
  • What is security pattern?
  • Security pattern landscape
  • SREBP
  • Examples of security risk-oriented patterns
  • Pattern identification and security requirements elicitation
  • Case study

416 ¡

slide-9
SLIDE 9

Security ¡Pa3erns ¡

417 ¡

slide-10
SLIDE 10

Security Patterns

  • A security pattern describes

– a particular recurring security problem – that arises in a specific security context – presents a well-proven generic scheme for a security solution

  • Codify security knowledge in structured and

understandable way

  • Presentation is familiar to the audience
  • Proven solutions improve the integration of security

into enterprises where needed

418 ¡

slide-11
SLIDE 11

Lecture outline

  • What is pattern?
  • What is security pattern?
  • Security pattern landscape
  • SREBP
  • Examples of security risk-oriented patterns
  • Pattern identification and security requirements elicitation
  • Case study

419 ¡

slide-12
SLIDE 12

Security Pattern Landscape

420 ¡

  • 1. Enterprise Security and Risk Management
  • 2. Identification and Authentication
  • 3. Access Control Model
  • 4. System Access Control Architecture
  • 5. Operating System Access Control
  • 6. Accounting
  • 7. Firewall Architecture
  • 8. Secure Internet Applications
  • 9. Cryptographic Key Management patterns
slide-13
SLIDE 13

Security Pattern Landscape

421 ¡

slide-14
SLIDE 14
  • 1. Enterprise Security and Risk Management

422 ¡

  • Content: The enterprise has some function or mission and

wants to address security issues as they relate to that mission

slide-15
SLIDE 15
  • 2. Identification and Authentication

423 ¡

  • Content: Specific requirements and design for the

identification and authentication services

slide-16
SLIDE 16
  • 3. Access Control Model

424 ¡

  • Content: High level models represent the security policies of

the requirements. These models define security constraints at the architectural level, the application level, and are enforced by the lower levels.

slide-17
SLIDE 17
  • 4. System Access Control Architecture

425 ¡

  • Essential for systems that permit or deny their use explicitly.

Patterns deal with the architecture of the software systems.

slide-18
SLIDE 18
  • 5. Operating System Access Control

426 ¡

  • Access control in operating systems

– Authenticator – Controlled process creator – Controlled object factory – Controlled object monitor – Controlled virtual address space – Execution domain – Controlled execution environment – File authorization

slide-19
SLIDE 19
  • 6. Accounting

427 ¡

  • Security audit and accounting

– Risk events are violations that occur during operational activities. Decision makers need to be aware of the events that occur involving the assets

slide-20
SLIDE 20
  • 7. Firewall Architecture

428 ¡

  • Represent trade-offs between complexity, speed, and security,

and which are tailored to control attacks on specific layers of the network

Proxy-based firewall Packet filter firewall Statefull firewall Address ¡filtering ¡ Keep ¡state ¡ Address ¡filtering ¡ Proxy ¡filtering ¡ Keep ¡state ¡ Firewall ¡pa3ern ¡relaDonship ¡

slide-21
SLIDE 21
  • 8. Secure Internet Applications

429 ¡

slide-22
SLIDE 22
  • 9. Cryptographic Key Management

430 ¡

  • Fundamental role in secure communication

– Secure communication

– Cryptographic key generation – Session key exchange with public keys – Public key exchange – Public key database – Session key exchange with server-side certificate – Session key exchange with certificates – Certificate authority – Cryptographic smart card – Certificate revocation

slide-23
SLIDE 23

Patterns on Threats to the System

Uzunov A. V., E. B. Fernandez, An Extensible Pattern-based Library and Taxonomy of Security Threats for Distributed Systems, Computer Standards & Interfaces, 2014

First level threats

  • Identify attacks
  • Network communication attacks
  • Network protocol attacks
  • Passing illegal data attacks
  • Stored data attacks
  • Remote information inference
  • Loss of accountability
  • Uncontrolled operations

431 ¡

Second level threats

  • Cryptography attacks
  • Countermeasure design
  • Configuration/ administration
  • Network protocol threats
slide-24
SLIDE 24

Lecture outline

  • What is pattern?
  • What is security pattern?
  • Security pattern landscape
  • SREBP
  • Examples of security risk-oriented patterns
  • Pattern identification and security requirements elicitation
  • Case study

432 ¡

slide-25
SLIDE 25

SREBP: Security Requirements Elicitation from Business Proceses

433

slide-26
SLIDE 26

Understanding ¡work ¡pracDces ¡and ¡their ¡changes ¡

Processing ¡of ¡Informa/on ¡

  • Capturing ¡informa/on ¡

– Keyboard, ¡bar ¡code ¡reader, ¡ digital ¡camera ¡

  • Transmi5ng ¡informa/on ¡

– Wired-­‑, ¡wireless-­‑phone ¡

  • Storing ¡informa/on ¡

– Hard ¡disk, ¡memory ¡card, ¡ internet ¡

  • Retrieving ¡informa/on ¡ ¡

– From ¡any ¡storage ¡device ¡

  • Manipula/ng ¡informa/on ¡

– CalculaDons, ¡combinaDons ¡of ¡ data ¡

  • Displaying ¡informa/on ¡

– Monitor, ¡printer ¡

¡434 ¡ ¡

Everything that IT does, reduces to six functions

slide-27
SLIDE 27

Football Federation Case

435 ¡ ¡435 ¡ ¡

slide-28
SLIDE 28

Football Federation Case

436 ¡ ¡436 ¡ ¡

slide-29
SLIDE 29

Lecture outline

  • What is pattern?
  • What is security pattern?
  • Security pattern landscape
  • SREBP
  • Examples of security risk-oriented patterns
  • Pattern identification and security requirements elicitation
  • Case study

437 ¡

slide-30
SLIDE 30

Security Risk-oriented Patterns

SRP1: Secure data from unauthorized access SRP2: Secure data transmitted between business entities SRP3: Secure business activity after data is submitted SRP4: Secure business services against denial of service attacks SRP5: Secure data stored in / retrieved from the data store

438

[Ahmed and Matulevičius, 2014] ¡438 ¡ ¡

slide-31
SLIDE 31

Pattern structure

439 ¡

slide-32
SLIDE 32

SRP2: Securing data that flow between the business entities

440 ¡

slide-33
SLIDE 33

Security Risk-oriented Patterns

SRP1: Secure data from unauthorized access SRP2: Secure data transmitted between business entities SRP3: Secure business activity after data is submitted SRP4: Secure business services against denial of service attacks SRP5: Secure data stored in / retrieved from the data store

441

[Ahmed and Matulevičius, 2014] ¡441 ¡ ¡

slide-34
SLIDE 34

Security Risk-oriented Patterns

SRP1: Secure data from unauthorized access SRP2: Secure data transmitted between business entities SRP3: Secure business activity after data is submitted SRP4: Secure business services against denial of service attacks SRP5: Secure data stored in / retrieved from the data store

442

[Ahmed and Matulevičius, 2014] ¡442 ¡ ¡

slide-35
SLIDE 35

Security Risk-oriented Patterns

SRP1: Secure data from unauthorized access SRP2: Secure data transmitted between business entities SRP3: Secure business activity after data is submitted SRP4: Secure business services against denial of service attacks SRP5: Secure data stored in / retrieved from the data store

443

[Ahmed and Matulevičius, 2014] ¡443 ¡ ¡

slide-36
SLIDE 36

Security Risk-oriented Patterns

SRP1: Secure data from unauthorized access SRP2: Secure data transmitted between business entities SRP3: Secure business activity after data is submitted SRP4: Secure business services against denial of service attacks SRP5: Secure data stored in / retrieved from the data store

444

[Ahmed and Matulevičius, 2014] ¡444 ¡ ¡

slide-37
SLIDE 37

Security Risk-oriented Patterns

SRP1: Secure data from unauthorized access SRP2: Secure data transmitted between business entities SRP3: Secure business activity after data is submitted SRP4: Secure business services against denial of service attacks SRP5: Secure data stored in / retrieved from the data store

445

[Ahmed and Matulevičius, 2014] ¡445 ¡ ¡

slide-38
SLIDE 38

Security Risk-oriented Patterns

SRP1: Secure data from unauthorized access SRP2: Secure data transmitted between business entities SRP3: Secure business activity after data is submitted SRP4: Secure business services against denial of service attacks SRP5: Secure data stored in / retrieved from the data store

446

[Ahmed and Matulevičius, 2014] ¡446 ¡ ¡

slide-39
SLIDE 39

Security Risk-oriented Patterns

SRP1: Secure data from unauthorized access SRP2: Secure data transmitted between business entities SRP3: Secure business activity after data is submitted SRP4: Secure business services against denial of service attacks SRP5: Secure data stored in / retrieved from the data store

447

[Ahmed and Matulevičius, 2014] ¡447 ¡ ¡

slide-40
SLIDE 40

Security Risk-oriented Patterns

SRP1: Secure data from unauthorized access SRP2: Secure data transmitted between business entities SRP3: Secure business activity after data is submitted SRP4: Secure business services against denial of service attacks SRP5: Secure data stored in / retrieved from the data store

448

[Ahmed and Matulevičius, 2014] ¡448 ¡ ¡

slide-41
SLIDE 41

Security Risk-oriented Patterns

SRP1: Secure data from unauthorized access SRP2: Secure data transmitted between business entities SRP3: Secure business activity after data is submitted SRP4: Secure business services against denial of service attacks SRP5: Secure data stored in / retrieved from the data store

449

[Ahmed and Matulevičius, 2014] ¡449 ¡ ¡

slide-42
SLIDE 42

Security Risk-oriented Patterns

SRP1: Secure data from unauthorized access SRP2: Secure data transmitted between business entities SRP3: Secure business activity after data is submitted SRP4: Secure business services against denial of service attacks SRP5: Secure data stored in / retrieved from the data store

450

[Ahmed and Matulevičius, 2014] ¡450 ¡ ¡

slide-43
SLIDE 43

Security Risk-oriented Patterns

SRP1: Secure data from unauthorized access SRP2: Secure data transmitted between business entities SRP3: Secure business activity after data is submitted SRP4: Secure business services against denial of service attacks SRP5: Secure data stored in / retrieved from the data store

451

[Ahmed and Matulevičius, 2014] ¡451 ¡ ¡

slide-44
SLIDE 44

Security Risk-oriented Patterns

SRP1: Secure data from unauthorized access SRP2: Secure data transmitted between business entities SRP3: Secure business activity after data is submitted SRP4: Secure business services against denial of service attacks SRP5: Secure data stored in / retrieved from the data store

452

[Ahmed and Matulevičius, 2014] ¡452 ¡ ¡

slide-45
SLIDE 45

Security Risk-oriented Patterns

SRP1: Secure data from unauthorized access SRP2: Secure data transmitted between business entities SRP3: Secure business activity after data is submitted SRP4: Secure business services against denial of service attacks SRP5: Secure data stored in / retrieved from the data store

453

[Ahmed and Matulevičius, 2014] ¡453 ¡ ¡

slide-46
SLIDE 46

Security Risk-oriented Patterns

SRP1: Secure data from unauthorized access SRP2: Secure data transmitted between business entities SRP3: Secure business activity after data is submitted SRP4: Secure business services against denial of service attacks SRP5: Secure data stored in / retrieved from the data store

454

[Ahmed and Matulevičius, 2014] ¡454 ¡ ¡

slide-47
SLIDE 47

Security Risk-oriented Patterns

SRP1: Secure data from unauthorized access SRP2: Secure data transmitted between business entities SRP3: Secure business activity after data is submitted SRP4: Secure business services against denial of service attacks SRP5: Secure data stored in / retrieved from the data store

455

[Ahmed and Matulevičius, 2014] ¡455 ¡ ¡

slide-48
SLIDE 48

Security Risk-oriented Patterns

SRP1: Secure data from unauthorized access SRP2: Secure data transmitted between business entities SRP3: Secure business activity after data is submitted SRP4: Secure business services against denial of service attacks SRP5: Secure data stored in / retrieved from the data store

456

[Ahmed and Matulevičius, 2014] ¡456 ¡ ¡

slide-49
SLIDE 49

Security Risk-oriented Patterns

SRP1: Secure data from unauthorized access SRP2: Secure data transmitted between business entities SRP3: Secure business activity after data is submitted SRP4: Secure business services against denial of service attacks SRP5: Secure data stored in / retrieved from the data store

457

[Ahmed and Matulevičius, 2014] ¡457 ¡ ¡

slide-50
SLIDE 50

Security Risk-oriented Patterns

SRP1: Secure data from unauthorized access SRP2: Secure data transmitted between business entities SRP3: Secure business activity after data is submitted SRP4: Secure business services against denial of service attacks SRP5: Secure data stored in / retrieved from the data store

458

[Ahmed and Matulevičius, 2014] ¡458 ¡ ¡

slide-51
SLIDE 51

Security Risk-oriented Patterns

SRP1: Secure data from unauthorized access SRP2: Secure data transmitted between business entities SRP3: Secure business activity after data is submitted SRP4: Secure business services against denial of service attacks SRP5: Secure data stored in / retrieved from the data store

459

[Ahmed and Matulevičius, 2014] ¡459 ¡ ¡

slide-52
SLIDE 52

Security Risk-oriented Patterns

SRP1: Secure data from unauthorized access SRP2: Secure data transmitted between business entities SRP3: Secure business activity after data is submitted SRP4: Secure business services against denial of service attacks SRP5: Secure data stored in / retrieved from the data store

460

[Ahmed and Matulevičius, 2014] ¡460 ¡ ¡

slide-53
SLIDE 53

Security Risk-oriented Patterns

SRP1: Secure data from unauthorized access SRP2: Secure data transmitted between business entities SRP3: Secure business activity after data is submitted SRP4: Secure business services against denial of service attacks SRP5: Secure data stored in / retrieved from the data store

461

[Ahmed and Matulevičius, 2014] ¡461 ¡ ¡

slide-54
SLIDE 54

Lecture outline

  • What is pattern?
  • What is security pattern?
  • Security pattern landscape
  • SREBP
  • Examples of security risk-oriented patterns
  • Pattern identification and security requirements elicitation
  • Case study

462 ¡

slide-55
SLIDE 55

Pattern application

463 ¡

slide-56
SLIDE 56

Football Federation Case

464 ¡ ¡464 ¡ ¡

slide-57
SLIDE 57

Football Federation Case

465 ¡ ¡465 ¡ ¡

slide-58
SLIDE 58

Football Federation Case SRP1: Secure data from unauthorized access

466 ¡ ¡466 ¡ ¡

slide-59
SLIDE 59

Football Federation Case SRP1: Secure data from unauthorized access

467 ¡

  • 1. Identify resource
  • 2. Identify roles
  • 3. (Assign users)
  • 4. Identify secured operations
  • 5. Assign permissions (and

security constraints)

¡467 ¡ ¡

slide-60
SLIDE 60

Role-based Access Control

468 ¡

slide-61
SLIDE 61

Role-based Access Control

469 ¡

SecReq.1: Umpire should be able to update the GameReport.gameDetails. SecReq.2: FootballFederationEmloyee should be able to insert the GameReport (i.e., create a new instance of GameReport). SecReq.3: FootballFederationEmloyee should be able to update the GameReport.gameInfo, GameReport.gameDetails and GameReport.confirmation.

slide-62
SLIDE 62

Football Federation Case SRP2: Secure data transmitted between business entities

470 ¡ ¡470 ¡ ¡

slide-63
SLIDE 63

Football Federation Case SRP2: Secure data transmitted between business entities

471 ¡

  • 1. Identify

communicators

  • 2. Identify data

transmission

¡471 ¡ ¡

slide-64
SLIDE 64

SRP2: Securing data that flow between the business entities

Requirements to Secure Communication ¡

472

slide-65
SLIDE 65

SRP2: Securing data that flow between the business entities

Requirements to Secure Communication ¡

473

  • SecReq.4: ERIS should have unique identity in the form of

key pairs (public key, private key) certified by a certification authority.

  • SecReq.5: Umpire should encrypt and sign Initial game

details (and other date communicated to ERIS) using keys before sending it to ERIS.

slide-66
SLIDE 66

Football Federation Case SRP3: Secure business activity after data is submitted

474 ¡

  • 1. Identify input interfaces
  • 2. Identify input data

¡474 ¡ ¡

slide-67
SLIDE 67

Football Federation Case SRP3: Secure business activity after data is submitted

475 ¡

  • 1. Identify input interfaces
  • 2. Identify input data

SecReq.7: Update game details should filter the input (i.e., Initial game details and Updates game details). SecReq.8: Update game details should sanitise the input (i.e., Initial game details and Updates game details) to transform it to the required format. SecReq.9: Update game details should canonicalise the input (i.e., Initial game details and Updates game details) to verify against its canonical representation.

¡475 ¡ ¡

slide-68
SLIDE 68

Football Federation Case SRP4: Securing business activity after data is submitted

476 ¡

  • 1. Identify functional-unit
  • 2. Identify business partner

¡476 ¡ ¡

slide-69
SLIDE 69

Football Federation Case SRP4: Securing business activity after data is submitted

477 ¡

slide-70
SLIDE 70

Football Federation Case SRP4: Securing business activity after data is submitted

478 ¡

SecReq.10: Update game details should establish a rule base (i.e., a collection of constraints used by different firewalls) to communicate with Umpire. SecReq.11: Packet Filter Firewall should filter the Umpire’s address to determine if it is not a host used by the threat agent. SecReq.12: Proxy Based Firewall should communicate to the proxy which represents Update game details to determine the validity of request received from Umpire. SecReq.13: State Firewall should maintain the state table to check the Umpire’s request for additional conditions of established communication.

slide-71
SLIDE 71

Football Federation Case SRP5: Securing data stored in/retrieved from the data store

479 ¡

  • 1. Identify Datastore

resource

  • 2. Identify Datastore’s
  • perations:

¡479 ¡ ¡

slide-72
SLIDE 72

Football Federation Case SRP5: Securing data stored in/retrieved from the data store

480 ¡

SecReq.14: The ERIS should audit the operations after the retrieval, storage or any other manipulation of data in the Game database. SecReq.15: The ERIS should perform operations to hide/unhide data when they are stored/retrieved to/from the Game database.

slide-73
SLIDE 73

Security Requirements

SecReq.1: Umpire should be able to update the GameReport.gameDetails. SecReq.2: FootballFederationEmloyee should be able to insert the GameReport (i.e., create a new instance

  • f GameReport).

SecReq.3: FootballFederationEmloyee should be able to update the GameReport.gameInfo, GameReport.gameDetails and GameReport.confirmation. SecReq.4: ERIS should have unique identity in the form of key pairs (public key, private key) certified by a certification authority. SecReq.5: Umpire should encrypt and sign Initial game details (and other date communicated to ERIS) using keys before sending it to ERIS. SecReq.7: Update game details should filter the input (i.e., Initial game details and Updates game details). SecReq.8: Update game details should sanitise the input (i.e., Initial game details and Updates game details) to transform it to the required format. SecReq.9: Update game details should canonicalise the input (i.e., Initial game details and Updates game details) to verify against its canonical representation. SecReq.10: Update game details should establish a rule base (i.e., a collection of constraints used by different firewalls) to communicate with Umpire. SecReq.11: Packet Filter Firewall should filter the Umpire’s address to determine if it is not a host used by the threat agent. SecReq.12: Proxy Based Firewall should communicate to the proxy which represents Update game details to determine the validity of request received from Umpire. SecReq.13: State Firewall should maintain the state table to check the Umpire’s request for additional conditions of established communication. SecReq.14: The ERIS should audit the operations after the retrieval, storage or any other manipulation of data in the Game database. SecReq.15: The ERIS should perform operations to hide/unhide data when they are stored/retrieved to/from the Game database.

slide-74
SLIDE 74

Security Requirements

SecReq.1: Umpire should be able to update the GameReport.gameDetails. SecReq.2: FootballFederationEmloyee should be able to insert the GameReport (i.e., create a new instance

  • f GameReport).

SecReq.3: FootballFederationEmloyee should be able to update the GameReport.gameInfo, GameReport.gameDetails and GameReport.confirmation. SecReq.4: ERIS should have unique identity in the form of key pairs (public key, private key) certified by a certification authority. SecReq.5: Umpire should encrypt and sign Initial game details (and other date communicated to ERIS) using keys before sending it to ERIS. SecReq.7: Update game details should filter the input (i.e., Initial game details and Updates game details). SecReq.8: Update game details should sanitise the input (i.e., Initial game details and Updates game details) to transform it to the required format. SecReq.9: Update game details should canonicalise the input (i.e., Initial game details and Updates game details) to verify against its canonical representation. SecReq.10: Update game details should establish a rule base (i.e., a collection of constraints used by different firewalls) to communicate with Umpire. SecReq.11: Packet Filter Firewall should filter the Umpire’s address to determine if it is not a host used by the threat agent. SecReq.12: Proxy Based Firewall should communicate to the proxy which represents Update game details to determine the validity of request received from Umpire. SecReq.13: State Firewall should maintain the state table to check the Umpire’s request for additional conditions of established communication. SecReq.14: The ERIS should audit the operations after the retrieval, storage or any other manipulation of data in the Game database. SecReq.15: The ERIS should perform operations to hide/unhide data when they are stored/retrieved to/from the Game database.

  • 1. Prioritise security requirements
  • 2. Introduce security requirements and the

security constraints to the business process model

  • 3. Implement security requirements
slide-75
SLIDE 75

Football Federation Case SRP5: Securing data stored in/retrieved from the data store

483 ¡

SecReq.2 ¡ SecReq.3 ¡ SecReq.1 SecReq.7 SecReq.10 ¡ SecReq.11 ¡ SecReq.4 ¡ SecReq.3 ¡ SecReq.3 ¡ SecReq.4 ¡ SecReq.13 ¡

¡483 ¡ ¡

slide-76
SLIDE 76

Lecture outline

  • What is pattern?
  • What is security pattern?
  • Security pattern landscape
  • SREBP
  • Examples of security risk-oriented patterns
  • Pattern identification and security requirements elicitation
  • Case study

484 ¡

slide-77
SLIDE 77

Pattern-based versus Traditional

Research questions

Which approach – pattern based or traditional – contributes with more complete set of requirements?

485 ¡

slide-78
SLIDE 78

Pattern-based versus Traditional

INPUT: 16 diagrams of operational business processes

486 ¡

slide-79
SLIDE 79

Pattern-based versus Traditional

SREBP versus SQUARE

487 ¡

  • SREBP:

– Application of the SRP patterns

SQUARE: System Quality Requirements Engineering

1. Agreement on definitions 2. Identification of security goals 3. Development of artefacts 4. Perform risk assessment 5. Select elicitation techniques 6. Elicit security requirements 7. Categorise requirements 8. Prioritize requirements 9. Inspect requirements

slide-80
SLIDE 80

Pattern-based versus Traditional

SREBP versus SQUARE

488 ¡

  • Seven business assets:

– Project offer, Project, Sample quality, Purchase

  • rder, Sample plate,

Process sample sheet, and Sample result

  • SREBP – around 220

security requirements

  • SQUARE – around 170

security requirements

SREBP ¡ SQUARE ¡ ¡ ¡ ¡488 ¡ ¡

slide-81
SLIDE 81

Pattern-based versus Traditional

SREBP versus SQUARE

489 ¡

  • Seven business assets:

– Project offer, Project, Sample quality, Purchase

  • rder, Sample plate,

Process sample sheet, and Sample result

  • SREBP – around 220

security requirements

  • SQUARE – around 170

security requirements

83 % versus 44 % SREBP results in more complete set of security requirements than SQUARE

SREBP ¡ SQUARE ¡ ¡ ¡

slide-82
SLIDE 82

Summary

  • What is pattern?
  • What is security pattern?
  • Security pattern landscape
  • SREBP
  • Examples of security risk-oriented patterns
  • Pattern identification and security requirements elicitation
  • Case study

490 ¡

slide-83
SLIDE 83

¡491 ¡ ¡ 491 ¡