Strategic modeling for security and design

点击翻译按钮获取中文摘要

As information and telecom services are increasingly being offered over the internet, security must now be considered from the outset of service conception and design. It is widely recognized that security cannot be achieved by technological means alone. Techniques from Requirements Engineering, an area of software engineering that deals with the relationship between a system and its surrounding environment, can be used to guide the design of software-enabled services, and to deal with the complex security challenges that arise. We aim to develop modeling techniques to facilitate the explicit incorporation of security considerations in the design process - from initial service conception to technical architecture design. The approach will build on modeling and analysis techniques developed in software requirements engineering, including strategic social actors modeling, scenarios, analysis of threats, impacts and risk, and other techniques. The resulting models also aim to facilitate communication and interaction among business designers, security engineers, and system developers throughout the service and system lifecycle, and to support cross-disciplinary understanding and informed design decision making and tradeoffs.