SCAM - Security-Centric Architecture Modelling
It is impossible to imagine today's world without software: whether it is smartphones, with which we carry a powerful computer with us almost everywhere and are connected to the Internet around the clock, highly scalable cloud applications that we use in our everyday working lives, airports, hospitals, supermarkets - the list of areas in which software is used in one form or another seems endless. Being surrounded by software, most of which being connected to the internet all the time, i.e. 24/7 potential vulnerabilities for outside intruders and attackers, emphesizes the need for highly secure software systems. In order to cope with the high complexity introduced by solutions of security requirements in software architecture, appropriate modelling techniques are required. Although some approaches to security modeling have been developed in recent years, it is still difficult and cumbersome to design, maintain, and evaluate the security architecture of a software system. This is partly because security modeling and architecture modeling belong together, since security solutions can affect the architecture of the software system, but they are handled as separate topics. For instance, threat modeling can be used to identify potential threats in a software system and to design countermeasures for these threats. However, looking at the architecture description documents after the fact, it is not apparent what solutions have been incorporated to address threats, making it much more difficult to evaluate the security architecture of a software system. This research project aims to develop and test new approaches to get a better view of security from an architectural perspective.
