Threat scenarios as a means to formally develop secure systems
Volkmar Lotz · Journal of Computer Security · 1997
We introduce a new method for the formal development of secure systems that closely corresponds to the way secure systems are developed in practice. It is based on FOCUS, a general-purpose approach to the design and verification of distributed, inter