Threat-Driven Architectural Design of Secure Information Systems
misuse cases : use cases with hostile intent .