Business-driven application security: From modeling to managing secure applications

TLDR

Business-driven development and management of secure applications is becoming essential, with diverse enterprise roles contributing to modeling, deployment, and policy implementation, and systematic approaches linking business artifacts to implementation artifacts guided by best practices and reusable templates. The study proposes a policy‑driven, model‑based approach to address security requirements across the business‑application life cycle. The approach models security policies with rule templates tied to business processes, implements them via infrastructure‑ or application‑managed environments, deploys and customizes them across the enterprise, and monitors compliance through IT and business dashboards while extending standards such as BPEL and UML for SOA interoperability. The approach enables management and monitoring of system behavior to ensure adherence and compliance with security policies.

Abstract

Business-driven development and management of secure applications and solutions is emerging as a key requirement in the realization of an on demand enterprise. In a given enterprise, individuals acting in various roles contribute to the modeling, development, deployment, and management of the security aspects of a business application. We look at the business-application life cycle and propose a policy-driven approach overlaid on a model-driven paradigm for addressing security requirements. Our approach suggests that security policies are to be modeled using policies and rule templates associated with business processes and models, designed and implemented through infrastructure-managed or application-managed environments based on modeled artifacts, deployed into an infrastructure and potentially customized to meet the security requirements of the consumer, and monitored and managed to reflect a consistent set of policies across the enterprise and all layers of its application infrastructure. We use a pragmatic approach to identify intersection points between the platform-independent modeling of security policies and their concrete articulation and enforcement. This approach offers a way to manage and monitor systems behavior for adherence and compliance to policies. Monitoring may be enabled through both information technology (IT) and business dashboards. Systematic approaches to connect business artifacts to implementation artifacts help implement business policies in system implementations. Best practices and security usage patterns influence the design of reusable and customizable templates. Because interoperability and portability are important in service-oriented architecture (SOA) environments, we list enhancements to standards (e.g., Business Process Execution Language [BPEL], Unified Modeling Language™ [UML®]) that must be addressed to achieve an effective life cycle.