A comprehensive pattern-oriented approach to engineering security methodologies

Assessing and improving the quality of security methodologies for distributed systems

“…In this section, we provide background on security methodologies and our previously proposed approach to engineering them. Some of the material (especially in Section 2.1) is taken from Uzunov et al, with adaptation where appropriate. We conclude the section with an overview of our proposal for assessing and improving security methodology quality in this paper—which, as explained in the Introduction, is elaborated in the context of the aforementioned security methodology engineering approach.…”

“…Over the last two decades, a number of researchers have come to regard fixed, “one‐size‐fits‐all” development methodologies as inadequate and unable to meet the needs of different organizations—a realization that has given impetus to the field of (Situational) Method Engineering—(S)ME . Similar arguments can be adduced with respect to security methodologies (see Uzunov et al), which has led to the proposal of a comprehensive, pattern‐oriented approach to engineering security methodologies in Uzunov et al inspired by a number of SME ideas.…”

“…In this paper, we aim to fill the latter gaps by proposing a comprehensive, extensible quality framework and accompanying assessment/improvement process, within the context of a previously proposed approach to engineering security methodologies, which can be used for both (bottom‐up) quality assessment—a posteriori methodology design—and (top‐down) quality improvement—determining requirements and guiding methodology design decisions—in the spirit of software quality engineering (see Côté et al and Tian). With the use of profiles, the main framework elements can be augmented and customized to allow an essentially arbitrary range of methodology features to be considered for a given project situation, thus forming a basis for flexible, fine‐grained quality control.…”

“…From the point of view of the aforementioned approach to engineering security methodologies, the proposed quality process (in its assessment capacity) is an amplification and detailed specification of the Methodology Verification stage of S‐SMEP (Situational Security Methodology Engineering Process)—a stage which received relatively cursory attention in Uzunov et al Perhaps more importantly, the quality framework and accompanying process presented in this paper can be viewed as constituting a stand‐alone meta‐methodology for security methodology quality control, complementing S‐SMEP and indeed any other related meta‐methodology or, more generally, any other approach for engineering security methodologies . Regardless of the viewpoint taken, utilizing the quality framework and improvement/assessment process can help to ensure that a given (security) methodology engineering approach does not merely provide a means of producing ad‐hoc methodologies with random qualities that “more or less fit the purpose”, but a means to systematically produce sensible methodologies—ie, methodologies of measurably good quality—suited precisely for the project situation at hand.…”

Formalization of Web Security Patterns

“…Yoder and Barcalow presented seven security patterns, which are applied to various software development issues [24]. A number of other varieties of security patterns are also available in the literature [19] [20] [22].…”