During the requirements and analysis stages of software development, the primary goal is to define precise requirements rather than being concerned with the details of software realizations. Security is a semantic aspect of applications and their constraints on the application should de described at this moment. From a security point of view we only want to indicate which specific security controls are needed, rather than getting involved with low-level design and implementation details. Therefore, at these stages, it is useful to have a set of patterns which define abstract security mechanisms. These patterns should specify only the fundamental characteristics of thesecurity mechanism or service, not specific software aspects. We present theconcept of Abstract Security Pattern (ASP), which describes a conceptual security mechanism that realizes one or more security policies able to handle a threat or comply with a securityrelated regulation or institutional policy. We present a detailed example of an ASP. We relate ASPs to each other using pattern diagrams as well as to Security Solution Frames and tactics. Finally, we discusstheir value for defining security requirements and for building secure systems.
Keywords:
@inproceedings{wer201401,
author = {Fernandez, E. B. and Yoshioka, N. and Washizaki, H. and Yoder, J.},
title = {Abstract security patterns for requirements specification and analysis of secure systems},
booktitle = {Anais do Workshop em Engenharia de Requisitos - Proceedings of the 17th Workshop on Requirements Engineering (WER2014)},
year = {2014},
issn = {2675-0066},
isbn = {978-1-63266-649-9},
doi = {}
}