Assurance for CyberSecurity with AssumeGuarantee Reasoning Design of cybersecurity solutions for a network is a challenging problem as it involves the integration of several complex components such as routers, servers, computers, smart devices, that include not only essential networking algorithms but also security algorithms. This is further complicated by the need to have robust security policies implemented to prevent violation of confidentiality as the networked devices interact. The design of such complex networked systems demand a more rigorous approach to the modeling and analysis at a higher level of abstraction, which can be inherited from the field of formal methods in software engineering for safety critical systems. Presently, network or security engineers do not use a formal method based software engineering approach to design and build cybersecurity systems. Thus, we propose a software engineering based formal approach to model and analyze cybersecurity, that along with identification of concrete requirements enables automated analysis to guarantee cybersecurity properties are satisfied within the network. In this research paper, we discuss an ontology guided assumeguarantee based formal approach to model and analyze a designed network. To enable this approach, a domain specific language is designed that allows association of assumptions with components in the network that allows verifying the satisfaction of contracts that are guarantees. The formal language designed includes reserved words are guided by the CyberSecurity domain and the semantic reasoning is based on formal architectural representation.

An Ontology for Security Patterns Security is a fundamental requirement that we must keep in mind when developing a system. We approach the secure construction of software through the use of security patterns, as a way to mitigate their threats. We propose an ontological approach to security patterns, with the aim of adding semantics to the elements that surround security patterns. We have added ontological descriptions to pattern descriptions to make their use more precise, to allow the development of appropriate tools to present to the developer the relevant patterns in each stage and to be able to build better pattern catalogs. A final objective would be the construction of a complete catalog where each pattern includes ontological descriptions. Our contributions are (i) a representation of security patterns in the form of ontology; (ii) examples through queries on the use of the ontology and (iii) a discussion of the possible uses of this ontology for secure software development.