Takanori Kobashi, Hironori Washizaki, Nobukazu Yoshioka, Haruhiko Kaiya, Takao Okubo, Yoshiaki Fukazawa, “Designing Secure Software by Testing Application of Security Patterns,” in Exploring Security in Software Architecture and Design, IGI Global, 2019. (invited)

Simply confirming potential threats and vulnerabilities in an early stage of the development process (e.g., the requirement- or design-phase) is insufficient because software developers are not necessarily security experts. Additionally, even if the software design considers security at an early stage, whether the software actually satisfies the security requirements must be confirmed. To realize secure design, we propose an application to design software systems with verification of security patterns using model testing. Our method provides extended security patterns, which include requirement- and design-level patterns as well as a new designing and model testing process that uses these patterns. Once developers specify threats and vulnerabilities in the target system in an early stage of development, our method can verify whether the security patterns are properly applied and assess if the vulnerabilities are resolved.