Preserving and Sharing Knowledge – Extending the UAF Security Views with Libraries, Patterns and Profiles

Abstract

AbstractKnowledge and experience are gained during the execution of every project. This knowledge remains in the heads of the engineers, but often is not distributed more widely. In Model‐Based Systems Engineering (MBSE) projects, this knowledge can include problem solving techniques, algorithms, libraries of types, patterns, interfaces, components, etc. One of the ways to preserve this knowledge is by creating libraries of these reusable assets. For example, the newest version of Unified Architecture Framework (UAF) included a library developed by Mitre of 1200 different security controls defined in National Institute of Standards and Technology (NIST) standard 800‐53r5. These controls can be referenced on projects to mitigate many common security risks. Each defined control can be integrated with the corresponding risks, security metrics, mitigating elements, solutions, and so forth. All these elements could then be used to construct Security Patterns showing risks that the security controls can mitigate as well as abstract solutions that can satisfy these controls. Patterns publicly provided as a curated, searchable, solution set library could be leveraged by projects and augmented over time, preserving their Intellectual Property (IP) and knowledge assets. This paper discusses these concepts and methods and demonstrates how they can be applied to improve system security.