Template and Tutorial

Security PatternsTemplate and Tutorial Darrell M. Kienzle, Ph.D.Matthew C. Elder, Ph.D.David S. TyreeJames Edwards-HewittIntroductionThere is a huge disconnect between security professionals and systems developers. Securityprofessionals are primarily concerned with the security of a system, while developers areprimarily concerned with building a system that works. While security is one of the non-functional goals that developers must be concerned with, it is but one of many. And whilesecurity professionals complain that developers don’t take security seriously, developers are justas frustrated that security professionals don’t understand that security is not their only concern.Security patterns are proposed as a means of bridging this gap. Security patterns are intended tocapture security expertise in the form of worked solutions to recurring problems. Securitypatterns are intended to be used and understood by developers who are not securityprofessionals. While the emphasis is on security, these patterns capture the strengths andweaknesses of different approaches in order to allow developers to make informed trade offdecisions between security and other goals.Above all, security patterns are meant to be constructive. Far too much of the available securityexpertise is presented in the form of laundry lists of what not to do. The poor developer whoattempts to understand security is likely to be overwhelmed by these lists. Security ...