CSE Security Group

Two basic principles of security are:

Security constraints should be defined at the highest layer, where their semantics are clear, and propagated to the lower levels, which enforce them.
All the layers of the architecture must be secure.

Our use of patterns is guided by these principles. We can define patterns at all levels. This allows a designer to make sure that all levels are secured, and also makes easier propagating down the high-level constraints. We catalog some of the patterns that apply to each layer, starting from the application layer. We address:

Patterns for security models
Patterns for operating systems
Patterns for firewalls and IDS
Patterns for distributed systems security
Patterns for web services security
Patterns for networks
Patterns for privacy

We can apply these patterns through a secure system development method that uses different mechanisms based on a hierarchical architecture whose layers define the scope of each security mechanism. This methodology is described in:

E.B.Fernandez and M.M.Larrondo-Petrie, "A methodology to build secure systems using patterns", 22nd Annual Computer Security Applications Conference (ACSAC), Works in Progress, Miami Beach, FL, Dec. 11-15. http://www.acsac.org
E.B. Fernandez, “Security patterns”, Procs. of the Eigth International Symposium on System and Information Security - SSI´2006,Keynote talk, Sao Jose dos Campos, Brazil, November 08-10, 2006.