Developing Secure Systems with UMLsec — From Business Processes to Implementation
Jan Jürjens · 2001
In practice, security of computer systems is compromised most often not by breaking dedicated mechanisms (such as security protocols), but by exploiting vulnerabilities in the way they are employed. We show how UML (the industry standard in object-oriented modelling) can be used to encapsulate rules of prudent security engineering to make them available to developers without a background in security. UML diagrams can be evaluated wrt. these rules, violations indicated and suggestions for modifications derived. We also show how to use transformations between UML models to introduce patterns by refinement.