How Security Design Patterns Are Important Tools For Secure Software Engineering

It is not uncommon to find various organizations complaining about security flaws in their information systems. Failing to prevent or mitigate the security flaws may lead to system breakdown, errors, and loss of crucial information. This is why it is important for users of information systems to find the right solutions that can help counter and mitigate security flaws. One common problem with security flaws connected with information systems or networks is that the security flaws occur in multiples. Technological advances have, fortunately, made it possible for people and organizations to prevent and detect such security flaws using security strategies. Layered Security and Defense in Depth are two strategies that can help prevent attacks and protect information systems against security flaws. The two strategies are similar but are based on completely two different concepts. This paper compares and contrasts the Layered Security and Defense in Depth Strategies by explaining how each of the two functions. Additionally, the paper includes an explanation about the advantages and disadvantages of the two strategies.

Sadly, there is no way to alleviate the numerous amounts of threats that haunt networks and computers worldwide. The foundation and framework for choosing and implementing countermeasures against them are very important. A written policy is vital in helping to insure that everyone within the organization understands and behaves in an appropriate manner with regards to the fact that sensitive data and the security of software should be kept safe.

Identify the fitting application security systems which we can execute in application in every situation.

Individual users play an important role in any form of institution or organization but concerns are raised about the security. The network administrators clearly lay down a set of rules, regulations and protocols that an individual user has to agree accordingly upon which part of the resources and what class of service that the user can obtain.

Miller Inc. which is in the business of providing data collection and analytics services relies majorly on network security to keep its competitive advantage. This is because the customers that rely on the company's system trust that since there are sufficient security measures that have been ensured, they can store their data securely. Each of the functional models of the system should have sufficient security measures to ensure that complete security of the whole system architecture is achieved. The three functional modules are the backend module, services or operation module and customer access module. The major relationship between infrastructure and security comes in the role they play to ensure that the end user gets the data that they need when they need it and in the best way possible. Therefore for the three modules, there is a need to balance security with the right infrastructure.

In writing this paper I spoke with Security Analysis and IT Security Policy Manager at my place of employment when researching this paper. They gave me some insightful direction as to the information, where to look for information and the important security issues to reference. Working in IT for the last 10 years I have also had to deal with many of these policies first hand. Additionally, I referenced the PowerPoints presented in class and The CISSP and CAP Prep Guide: Platinum Edition that I purchased and used for the quiz in class.

Patterns support high-level and reuse concept. By using these patterns we can adapt the implementation to suit the system that we are developing. Patterns are a great idea but we need experience of software design to use this pattern in effective way. We need to recognize situations where a pattern can be applied. The one who don’t have any experience also read the pattern books, should always able to find it hard to decide whether they can reuse a pattern or need to develop a special purpose solution.

SAML abstracts the security framework away from platform architecture and particular vendor implementation. This Service-Oriented Architecture makes the security more independent of application logic

The analytical methods applied on security pattern data yield results in the form of pattern clusters and concepts. Pattern applicability can be improved by making this classification and resulting concept knowledge readily available to practitioners. In order to make it readily available, the results must be represented in a suitable format. Further, it must be shared using a tool or technology which is easy to use and does not need any special hardware or software. In this chapter, we present our approach towards representing the gained knowledge and sharing it so that it can be accessed and used. The chapter outline is as follows. In Section 7.1, we present the knowledge discovery and its adoption for the present work. The first mining tool applied is clustering. The knowledge obtained using this mechanism is presented in Section 7.2. The second knowledge discovery technique used in the research is FCA. Section 7.3 gives an overview of the knowledge extracted using FCA. In Section 7.4, we give our views about knowledge sharing, the issues which need to be considered and our solutions to address them. The representation format for various knowledge elements is presented in Section 7.5. The knowledge search framework is presented in Section 7.6 followed by a discussion on the implementation aspects in Section 7.7. The chapter ends with a summary.

Christopher Alexander first introduced the concept of design patterns for use of living spaces, in his book ‘A Pattern Language’, published in 1977 [3]. The concept of a pattern was adopted by the software community in the book ‘Design Patterns: Elements of Reusable Object-Oriented Software’, published in 1994 whose authors Gamma, Helm, Johnson, and Vlissides are known as the ‘Gang of Four [4]. The first design patterns related to security were published by Yoder and Barcalow in 1997 which described 7 design patterns. Subsequently, many design patterns and pattern catalogs were published. Important contributions are by Romanosky [5], Kienzle et al. [6], Blakley and members of the Open Group security Forum [7], Hafiz et al. [8,9] and the Microsoft Patterns and Practices group [10,11]. In their book published in 2005, Schumacher and a working group of security pattern experts, discussed 46 patterns [12]. Steel et al. [13] compiled a catalog of 23 core security patterns for J2EE and web services. Dougherty et al., at the Carnegie Mellon Software Engineering Institute, described 15 design patterns in their guide to Secure Design Patterns [14]. Fernandez presented 68 design patterns in the book ‘Security Patterns in Practice: Designing Secure Architectures Using Software Patterns’ [15]. Today the total number of security design patterns is around 400 [16,17]. To

The first security kernel was developed by MITRE that ran on a DEC PDP 11/45 in 1975. This security kernel was developed to overcome the limitations of hardware and software technologies and the problem of security. The PDP-Secure System Design provides a design based on a general purpose mathematical model of secure computer systems [1]. The model is a finite state model which defines a set of rules of operation for making state

As the use of computers, databases, and technology in general, security has grown to be a powerful tool that has to be used. The threat of outside sources intruding and exploiting crucial information is a threat that is present on a daily basis. As a part of creating and implementing a security policy, a user must consider access control. Access Control is a security tool that is used to control who can use or gain access to the protected technology. Access control security includes two levels; logical and physical. Though database intrusions can happen at any moment, access control provides another security barrier that is needed.

All access to government servers, network devices and maintenance areas of the government agency's data center will be role-based and defined through authentication at a minimum (Amsel, 1988). Access methods will require two-party authentication and for access to server operating systems and rack-mounted servers, biometrics will also be required. One of the most critical success factors to ensuring a high level of security and stability and to guard again social engineering threats is to create and maintain authentication methods that thwart illusionary and coercive-driven access attempts (Burgess, Canright, Engø-Monsen, 2004). By having several roles requires to gain access to data,

• Semantic Relations: Patterns are related to other patterns. For example, some patterns may solve the same security goal or some patterns may be used at a specific lifecycle stage in software development. Classification methods have attempted to identify properties or attributes by which patterns can be tagged and classified. These classifiers form the semantic relations between patterns.

A design pattern must be represented in a structured manner so that it can be understood clearly and unambiguously. A good description enables the reader to grasp the essence of the pattern. It is expressed formally in terms of a pattern template. Several pattern template formats have been designed and used by researchers. The template used in this research work is based on the POSA book. Its elements and the description of each element are shown in Table 2.1.