DocumentCode :
635216
Title :
Automated software architecture security risk analysis using formalized signatures
Author :
Almorsy, Mohamed ; Grundy, John ; Ibrahim, Ahmed S.
Author_Institution :
Centre for Comput. & Eng. Software Syst., Swinburne Univ. of Technol., Melbourne, VIC, Australia
fYear :
2013
fDate :
18-26 May 2013
Firstpage :
662
Lastpage :
671
Abstract :
Reviewing software system architecture to pinpoint potential security flaws before proceeding with system development is a critical milestone in secure software development lifecycles. This includes identifying possible attacks or threat scenarios that target the system and may result in breaching of system security. Additionally we may also assess the strength of the system and its security architecture using well-known security metrics such as system attack surface, Compartmentalization, least-privilege, etc. However, existing efforts are limited to specific, predefined security properties or scenarios that are checked either manually or using limited toolsets. We introduce a new approach to support architecture security analysis using security scenarios and metrics. Our approach is based on formalizing attack scenarios and security metrics signature specification using the Object Constraint Language (OCL). Using formal signatures we analyse a target system to locate signature matches (for attack scenarios), or to take measurements (for security metrics). New scenarios and metrics can be incorporated and calculated provided that a formal signature can be specified. Our approach supports defining security metrics and scenarios at architecture, design, and code levels. We have developed a prototype software system architecture security analysis tool. To the best of our knowledge this is the first extensible architecture security risk analysis tool that supports both metric-based and scenario-based architecture security analysis. We have validated our approach by using it to capture and evaluate signatures from the NIST security principals and attack scenarios defined in the CAPEC database.
Keywords :
digital signatures; object-oriented languages; software architecture; software metrics; CAPEC database; NIST security principals; OCL; automated software architecture security risk analysis; formal signatures; formalized signatures; metric-based architecture security analysis; object constraint language; scenario-based architecture security analysis; secure software development lifecycles; security architecture; security flaws; security metrics signature specification; signature matches; system development; system security; Computer architecture; Measurement; Risk analysis; Security; Software; Software architecture; Unified modeling language; Architecture Security Risk analysis; Common attack patterns enumeration and classification (CAPEC); Formal attack patterns specification; Software security;
fLanguage :
English
Publisher :
ieee
Conference_Titel :
Software Engineering (ICSE), 2013 35th International Conference on
Conference_Location :
San Francisco, CA
Print_ISBN :
978-1-4673-3073-2
Type :
conf
DOI :
10.1109/ICSE.2013.6606612
Filename :
6606612
Link To Document :
بازگشت