Threat-Driven Design and Analysis of Secure Software Architectures

Computer software is a major source of security risks in information systems. To deal with software security issues in the early stages of software development, this paper presents a threat-driven approach to the architectural design and analysis of secure software. Based on the identification and mitigation of security threats as misuse use cases, we leverage use cases, misuse cases, and mitigation use cases to design architectural components and their connections for candidate architectures. We then analyze whether or not candidate architectures are resistant to the identified security threats and what constraints must be imposed on the choices of system implementation. This provides a smooth transition from requirements specification to high-level design and greatly improves the traceability of security concerns in high assurance software systems. We demonstrate our approach through two case studies; one on a hospital information system and one on a payroll information system.