Steps for Business Analyst To Gather Security Requirements from Misuse Cases
In this write-up, I will talk about misuse cases and steps to identify security requirements. Ivar Jacobson while working on large telecommunication systems introduced use cases. According to him use cases describe system's desired behavior in the form of a story ('Scenario')from the point view of a user or interfacing system('Actor') and supported by subsidiary scenarios in the form of alternatives and exceptions[Jacabson 1992]. On the other hand misuse cases are the inverse of use cases. The concept was coined in 1990s by Guttorm Sindre of the Norwegian University of Science and Technology, and Andreas L. Opdahl of the University of Bergen, Norway. The basic concept is describing the steps of performing a malicious act against a system, just as you would describe an act that the system is supposed to perform in a use case. So, use cases models the behavior expected from the system and misuse cases models the behavior not expected from the system.
Download the paper from below link.
| Attachment | Size |
|---|---|
| Misuse case.pdf | 493.84 KB |
But what is a misuse case
This is a great topic for discussion, but the article opens more questions than it answers.
A Negative Scenario is a scenario that is not desired by the organization - the question is, 'where do you stop?' there are an almost infinite # of these scenarios. For example, a 'Thief' may be an appropriate actor for a car system, but is it appropriate for a database application?
More information about what a misuse case looks like, with an example would help.
Showing a misuse case as a non-functional requirement is confusing. I might think of misuse cases as being modeled as exception flows on a use case. Security experts may be called in to identify significant areas where security needs to be added to the use case. Usually, this activity is delayed until the design phase, but I can see a benefit to including this during earlier phases.
Leslie.