The relationships between the work products of a security engineering process can be hard to understand, even for persons with a strong technical background but little knowledge of security engineering. Market forces are driving software practitioners who are not security specialists to develop software that requires security features. When these practitioners develop software solutions without appropriate securityspecific processes and models, they sometimes fail to produce effective solutions. We have adapted a proven object-oriented modeling technique, use cases, to capture and analyze security requirements in a simple way. We call the adaptation an abuse case model. Its relationship to other security engineering work products is relatively simple, from a user perspective.
McDermott and Fox adapt use cases REF to capture and analyze security requirements, and they call the adaption an abuse case model.
Using abuse case models for security requirements analysis
Proceedings 15th Annual Computer Security Applications Conference (ACSAC'99)
Proceedings 15th Annual Computer Security Applications Conference (ACSAC'99)
Computer Science