UNDERSTANDING AND COMMUNICATING IT SECURITY SPECIFICATIONS WITH UML

Abstract

Security specifications of IT products and systems are inherently complex and may subject products to semantic threats due to misunderstanding of key aspects of security objectives by developers, customers and end users. A study is conducted on expressing the security specifications by specially interpreted UML use case diagrams to avoid misunderstanding by peer groups, i.e. to prevent semantic threats at the development phase through improved comprehension of security specifications. We base our results on engineering frameworks for comprehensive security and demonstrate the need for improved communication by concrete examples of semantic threats. The threats result from the use of complex textual artifacts as a means of communicating the security requirements. We demonstrate the use of a diagrammatic technique for expressing and communicating security specifications in a less ambiguous manner and illustrate how the technique assists in communication.