Security risk modelling using SecureUML

Several security modelling languages (e.g., Misuse case, Secure Tropos) help dealing with security risk management at the system requirements stage. But no design level modelling language has been explored to model security risk. In this paper, we are focusing on SecureUML which is a design level modelling language to represent security risk. More specifically we investigate how SecureUML supports information systems security risks management (ISSRM). The outcome of this work is an alignment table between SecureUML language constructs to the constructs of the ISSRM domain model. We ground our analysis on the number of illustrative examples. We hope that our results will help developers to understand how they can consider security risks at the system design stage. It also indentifies the shortcomings of SecureUML to model security risk and provides recommendations for improvement.