Towards a Security Engineering Process

It is very difficult to make IT-systems secure as there are many different components and mechanisms involved such as operating systems, computer networks, and software engineering. Without a systematic methodology, security requirements are often retrofitted late in the design process or pursued separately from functional design. To fill this gap, we are currently working on a security engineering process which extends the software development process presented in [12]. The security engineering process will provide a rich set of expressive guidelines and functions, enforcing the integration of security aspects in early stages of the software development process. The basic building blocks of the process are high-level security requirements and mechanisms, which can be summarized in a so-called requirements/mechanisms matrix. The approach will be based on UML (Unified Modeling Language) which is a general-purpose, nonproprietary modeling language. UML includes all the concepts that are necessary to support a modern iterative software development process. Keywords: Security, Conceptual Security Modeling, Software Engineering.