Model-driven architectural risk analysis using architectural and contextualised attack patterns.

Faily, Shamal; Lyle, John; Namiluko, Cornelius; Atzeni, Andrea; Cameroni, Cesare

Abstract

A secure system architecture is often based on a variety of design and security model elements. Without some way of evaluating the impact of these individual design elements in the face of possible attacks, design flaws may weaken a software architecture. This paper illustrates how architectural and contextualised attack patterns can be used to formalise the elements of architectural attacks and possible defences. We illustrate how these patterns, and tool-support building upon them, can be used to automate an architectural risk analysis process. We demonstrate this approach using an example from the EU FP7 webinos project.

Citation

FAILY, S., LYLE, J., NAMILUKO, C., ATZENI, A. and CAMERONI, C. 2012. Model-driven architectural risk analysis using architectural and contextualised attack patterns. In Proceedings of the 1st Model-driven security workshop (MDsec 2012), co-located with the 15th International conference on model-driven engineering languages and systems (MoDELS 2012), 1-5 October 2012, Innsbruck, Austria. New York: ACM [online], article number 3. Available from: https://doi.org/10.1145/2422498.2422501

• Conference Name: 1st Model-driven security workshop (MDsec 2012), co-located with the 15th International conference on model-driven engineering languages and systems (MoDELS 2012)
• Conference Location: Innsbruck, Austria
• Start Date: Oct 1, 2012
• End Date: Oct 5, 2012
• Acceptance Date: Oct 1, 2012
• Online Publication Date: Oct 1, 2012
• Publication Date: Dec 31, 2012
• Deposit Date: Dec 8, 2021
• Publicly Available Date: Dec 8, 2021
• Publisher: Association for Computing Machinery (ACM)
• ISBN: 9781450318068
• DOI: https://doi.org/10.1145/2422498.2422501
• Keywords: Systems security; Security risk analysis; Software engineering
• Public URL: https://rgu-repository.worktribe.com/output/1427781