Identifying and Implementing Security Patterns for a Dependable Security Case -- From Security Patterns to D-Case

Security assurance cases—state of the art of an emerging approach

“…For five papers, the use of SAC can be categorised as providing process and life-cycle support. One paper Aid in communication as it provides a summary of issues and their interrelationship Patu and Yamamoto (2013b) Aid in the survival of modern system, with respect to security challenges Ray and Cleaveland (2015) Comply with internal needs from cyber-physical systems' manufacturers suggests to use SAC to communicate between organisations involved in developing and using medical devices and one paper uses SAC to teach students about information security.…”

“…There are 17 reported prerequisites. The majority belong to approaches (11) (Chindamaikul et al 2014;Cockram and Lautieri 2007;Cyra and Gorski 2007;Hawkins et al 2015;Patu and Yamamoto 2013a;Ankrum and Kromholz 2005;Cheah et al 2018;Sljivo and Gallina 2016;Tippenhauer et al 2014;Vivas et al 2011;Xu et al 2017) while the remaining ones belong to usage scenarios (2) (Bloomfield et al 2017;Goodger et al 2012), patterns (2) (Patu and Yamamoto 2013b;He and Johnson 2012), and tools (1) (Gacek et al 2014). We categorize prerequisites as follows: The studies in this category require the existence or performing certain analysis and models to achieve their purpose.…”

“…We found ten studies which deal with patterns. Six of these create their own argumentation patterns (Finnegan and McCaffery 2014a, b;He and Johnson 2012;Patu and Yamamoto 2013b;Poreddy and Corns 2011;Xu et al 2017). The remaining four include usage of patterns (Hawkins et al 2015;Tippenhauer et al 2014), a guideline for creating and documenting security case patterns (Weinstock et al 2007), and a catalogue of security and safety case patterns (Taguchi et al 2014).…”

“…Ben Othmane et al [8] Process improvement Assure security during iterative development Cheah et al [14] Process improvement Cope with the increasing connectivity of systems Cockram et al [16] Process improvement Reduces both technical and program risks through process improvement Gallo et al [26] Process improvement Factor analytical and implementation work per component, requisite, technology, or life-cycle Lipson et al [42] Process improvement Help analyzing complex systems Netkachova et al [50] Process improvement Tackle security issues which have intensified challenges of engineering safety-critical systems. Weinstock et al [75] Process improvement Include people and processes in security assurance in addition to technology Alexander et al [4] Security assessment Help security evaluators to focus their attention on critical parts of the system Bloomfield et al [11] Security assessment Ensure the fulfillment of security requirements Finnegan et al [21] Security assessment Improve overall security practices and demonstrate confidence in security Hawkins et al [34] Security assessment Justify and assess confidence in critical properties Knight [41] Security assessment Spot security related weaknesses in the system Poreddy et al [55] Security assessment Assist in identifying security loopholes while changing the system Rodes et al [57] Security assessment Measure software security Strielkina et al [69] Security assessment Acquire an input for decision making of requirement conformity Vivas et al [74] Security assessment Acquire confidence that the security of the system meets the requirements Agudo et al [3] Structure & documentation Incorporate certifications and evaluation methods in an evidence-based structure Alexander et al [4] Structure & documentation Summarize security thinking when vendors are involved Finnegan et al [22] Structure & documentation Communicate and report achieved security level Knight [41] Structure & documentation Document rational for security claims Netkachova et al [51] Structure & documentation Aid in communication as it provides a summary of issues and their interrelationship Patu et al [54] Structure & documentation Aid in the survival of modern system, with respect to security challenges Ray et al [56] Structure & documentation Comply with internal needs from cyber-physical systems' manufacturers ferent goals. We looked into...…”

“…-Usage of security standards(Ankrum and Kromholz 2005;Cyra and Gorski 2007): The studies in this category require the use of security standards to create SAC or make use of them. -Existence of analysis and modelling(Cheah et al 2018;Goodger et al 2012;Patu and Yamamoto 2013b;Xu et al 2017):…”