Strategic modeling for security and design

随着信息和电信服务越来越多地通过互联网提供，现在必须从服务概念和设计的一开始就考虑安全性。人们普遍认识到，安全不能单靠技术手段来实现。需求工程是处理系统与其周围环境之间关系的软件工程领域，来自需求工程的技术可用于指导支持软件的服务的设计，并处理出现的复杂安全挑战。我们的目标是开发建模技术，以促进在设计过程（从最初的服务概念到技术体系结构设计）中明确地合并安全考虑。该方法将建立在软件需求工程中开发的建模和分析技术的基础上，包括战略社会参与者建模、场景、威胁、影响和风险分析，以及其他技术。生成的模型还旨在促进整个服务和系统生命周期中业务设计师、安全工程师和系统开发人员之间的通信和交互，并支持跨学科理解和明智的设计决策制定和权衡。

As information and telecom services are increasingly being offered over the internet, security must now be considered from the outset of service conception and design. It is widely recognized that security cannot be achieved by technological means alone. Techniques from Requirements Engineering, an area of software engineering that deals with the relationship between a system and its surrounding environment, can be used to guide the design of software-enabled services, and to deal with the complex security challenges that arise. We aim to develop modeling techniques to facilitate the explicit incorporation of security considerations in the design process - from initial service conception to technical architecture design. The approach will build on modeling and analysis techniques developed in software requirements engineering, including strategic social actors modeling, scenarios, analysis of threats, impacts and risk, and other techniques. The resulting models also aim to facilitate communication and interaction among business designers, security engineers, and system developers throughout the service and system lifecycle, and to support cross-disciplinary understanding and informed design decision making and tradeoffs.