Using abuse case models for security requirements analysis

TLDR

Security engineering work products are difficult to understand, and non‑security specialists often lack appropriate processes, leading to ineffective security features. The study adapts the proven object‑oriented use‑case modeling technique to capture and analyze security requirements simply. This adaptation is called an abuse case model.

Abstract

The relationships between the work products of a security engineering process can be hard to understand, even for persons with a strong technical background but little knowledge of security engineering. Market forces are driving software practitioners who are not security specialists to develop software that requires security features. When these practitioners develop software solutions without appropriate security-specific processes and models, they sometimes fail to produce effective solutions. We have adapted a proven object oriented modeling technique, use cases, to capture and analyze security requirements in a simple way. We call the adaptation an abuse case model. Its relationship to other security engineering work products is relatively simple, from a user perspective.