Validating Security Design Pattern Applications by Testing Design Models

paper index | HOME

Title: Validating Security Design Pattern Applications by Testing Design Models
Author(s): Takanori Kobashi and Nobukazu Yoshioka and Haruhiko Kaiya and Hironori Washizaki and Takano Okubo and Yoshiaki Fukazawa
Source: International Journal of Secure Software Engineering (IJSSE), Vol. 5, Issue. 4, pp. 1-30, Dec. 2014. IGI-Global, DOI: 10.4018/ijsse.2014100101

Abstract:
Software developers are not necessarily security experts, confirming potential threats and vulnerabilities at an early stage of the development process (e.g., in the requirement- and design-phase) is insufficient. Additionally, even if designed software considers security at an early stage, whether the software really satisfies the security requirements must be confirmed. To realize secure design, this work proposes an application to validate security patterns using model testing. Its method provides extended security patterns, which include requirement- and design-level patterns as well as a new model testing process using these patterns. After a developer specifies threats and vulnerabilities in the target system during an early stage of development, this method can validate whether the security patterns are properly applied and assess if these vulnerabilities are resolved.