AND CONTROL IN THE NETWORKED ERA Modeling Security Architectures for the Enterprise STUDENT PAPER

Security is often treated, whether intentionally or otherwise, as something which can easily be added after a system is built. This has proven in many cases to cause substantial embarrassment and cost. Security must be designed into a system or enterprise, and integrated across all subsystems from the beginning. However, the tools and methodologies to perform security-related design are not well developed, defined, standardized, nor integrated. There are many possible ways that security can be modeled. Part of the problem is that security is sometimes considered a nonfunctional or performance system requirement, sometimes a functional system requirement, and sometimes simply an operational mission requirement. This paper explores ways to model each of these using current methodologies, and suggests a unifying theme for modeling security as a whole. Descriptions of how security can be modeled in DoDAF using structured and object oriented techniques are presented, how it is modeling in other frameworks and how the use of Colored Petri-Nets can be a potential candidate for security architectures