security engineering with patterns
DESCRIPTION
Security Engineering with Patterns. Markus Schumacher and Utz Roedig. Presented by Joe Combs15 March 2006. Agenda. What do patterns seek to accomplish? Other approaches How do the authors define a pattern? Security engineering using patterns Related work. - PowerPoint PPT PresentationTRANSCRIPT
![Page 1: Security Engineering with Patterns](https://reader036.vdocuments.site/reader036/viewer/2022083006/56813afa550346895da38b0d/html5/thumbnails/1.jpg)
Security Engineering with Patterns
Markus Schumacher and Utz Roedig
Presented by Joe Combs 15 March 2006
![Page 2: Security Engineering with Patterns](https://reader036.vdocuments.site/reader036/viewer/2022083006/56813afa550346895da38b0d/html5/thumbnails/2.jpg)
Agenda• What do patterns seek to accomplish?
• Other approaches
• How do the authors define a pattern?
• Security engineering using patterns
• Related work
![Page 3: Security Engineering with Patterns](https://reader036.vdocuments.site/reader036/viewer/2022083006/56813afa550346895da38b0d/html5/thumbnails/3.jpg)
What Problem are We Trying to Solve?
• Allow novices to act as security experts
• Give security experts a mechanism to identify, name and discuss both problems and solutions more effectively
• Solve problems in a structured way
• Identify and consider dependencies between components
![Page 4: Security Engineering with Patterns](https://reader036.vdocuments.site/reader036/viewer/2022083006/56813afa550346895da38b0d/html5/thumbnails/4.jpg)
Other approaches• Security policy
• Evaluation criteria
• Tree representations
• Formal methods
• Semi-formal approaches
![Page 5: Security Engineering with Patterns](https://reader036.vdocuments.site/reader036/viewer/2022083006/56813afa550346895da38b0d/html5/thumbnails/5.jpg)
Schumacher & Roedig Pattern Template
• Name
• Context and related patterns
• Problem
• Solution
• Other optional sections include aliases, structure and interactions of participants, consequences, examples and counter-examples
![Page 6: Security Engineering with Patterns](https://reader036.vdocuments.site/reader036/viewer/2022083006/56813afa550346895da38b0d/html5/thumbnails/6.jpg)
Pattern System Examples• Virtual Private Networks - Transport data over an
untrustworthy network
• Network Encryption Protocol - establish security/confidentiality between endpoints
• Network Authentication Protocol - establish identity and handshake between participants
• Cryptographic Protocol - need to decide which mechanism
![Page 7: Security Engineering with Patterns](https://reader036.vdocuments.site/reader036/viewer/2022083006/56813afa550346895da38b0d/html5/thumbnails/7.jpg)
Pattern System Examples
![Page 8: Security Engineering with Patterns](https://reader036.vdocuments.site/reader036/viewer/2022083006/56813afa550346895da38b0d/html5/thumbnails/8.jpg)
Security Engineering w/Patterns• Does this template does meet the criteria for
the problem we’re trying to solve?• security by non-experts• structured problem solution• scope & time dependencies
• Tool support needed:• maintenance• classification• modeling• reasoning
![Page 9: Security Engineering with Patterns](https://reader036.vdocuments.site/reader036/viewer/2022083006/56813afa550346895da38b0d/html5/thumbnails/9.jpg)
An Engineering Example
![Page 10: Security Engineering with Patterns](https://reader036.vdocuments.site/reader036/viewer/2022083006/56813afa550346895da38b0d/html5/thumbnails/10.jpg)
An Engineering Example
![Page 11: Security Engineering with Patterns](https://reader036.vdocuments.site/reader036/viewer/2022083006/56813afa550346895da38b0d/html5/thumbnails/11.jpg)
Conclusions• Need a way to support both formal & informal approaches to
achieve security
• Average programmers need a mechanism to design secure systems
• Several patterns offered as examples - need a classification scheme to develop a pattern system
• Need to establish a larger pattern community with repositories of patterns, tool support and so on for this to be effective