Implementation Support of Security Design Patterns Using Test Templates

Abstract

Security patterns are intended to support software developers as the patterns encapsulate security expert knowledge. However, these patterns may be inappropriately applied because most developers are not security experts, leading to threats and vulnerabilities. Here we propose a support method for security design patterns in the implementation phase of software development. Our method creates a test template from a security design pattern, consisting of an "aspect test template" to observe the internal processing and a "test case template". Providing design information creates a test from the test template with a tool. Because our test template is reusable, it can easily perform a test to validate a security design pattern. In an experiment involving four students majoring in information sciences, we confirm that our method can realize an effective test, verify pattern applications, and support pattern implementation.

Development of IoT Health Monitor System using Security Patterns

“…In literature, selection and application of security patterns for security requirements of IoT does not have empirical methodology. The limitation in [21] may overcome i.e Object Constraint Language (OCL) may not necessary to prepare Decision Table and pointcut advice Model (Aspect Programming) to understand the pattern internal processing. Instead of OCL, we can use Misuse case extension to prepare decision table and Pointcut Advice pair model.…”

“…We adapted Text Categorization Process [19], Restricted Misuse Case Modeling [20], validating security patterns using Test Template [21] approaches to extend our Methodology. The proposed Sa-SDLC methodology, integrate security patterns mechanisms in each phase of SDLC to reduce impact of vulnerabilities.…”

Towards forensic-ready software systems

“…Research is needed to answer a number of fundamental questions related to how requirements for forensic-ready systems should be implemented and whether these requirements are solely about data preservation activities. Architectural patterns (similar to security patterns [29]) could also be investigated to design forensic-ready systems. Additional challenges relate to managing trade-offs between forensic readiness requirements such as privacy and availability given that some of these could manifest at runtime.…”

Introduction to the Special Issue on Evaluating the Security of Complex Systems

“…Yoshizawa et al are concerned with implementation aspects of security patterns [8]. They indicate that developers may apply the patterns in ways that introduce vulnerabilities and propose a test template to determine if an applied pattern has introduced vulnerabilities.…”