Engineering security methodologies for distributed systems.

Over the last decade, researchers and practitioners have increasingly come to acknowledge that the introduction of security into software systems – especially complex, distributed systems – should proceed by means of a structured, systematic approach, combining principles from both software and security engineering. Such systematic approaches, particularly those implying some sort of process aligned with the development life-cycle, are termed security methodologies. While there are numerous methodologies in the literature, each with its own peculiar advantages and disadvantages, making it more or less suitable for a given set of project situations, none can lay claim to being universal, i.e. able to take into account all system-specific attributes, all technologies, all skill levels, and – in general – to be applicable to all project situations. In other words, the literature does not currently present developers with an “ideal” methodology (in an absolute sense); and, indeed, such a requirement would be infeasible, since “ideal” must necessarily be interpreted with respect to a given situation – encompassing system types, technologies, skillsets and whatever other qualities are seen as desirable. The problem facing the area is thus not so much the construction of “bigger and better” methodologies with novel or interesting features – i.e. (unattainably) ideal methodologies in an absolute sense – but the construction of (attainably) ideal methodologies for particular project situations. This thesis proposes a comprehensive solution to the latter problem by developing a conceptual “toolkit” for engineering security methodologies, with an emphasis on security methodologies for distributed systems. The “toolkit” consists of a number of inter-related parts: a framework of process patterns, a domain-specific meta-model and a unifying meta-methodology for constructing and tailoring security methodologies (for any system type); a set of generic conceptual security artefacts – usable across different methodologies – for addressing various networked and distributed systems security features and for supporting threat modeling in a networked/distributed systems context; and a framework for assessing and improving security methodology quality, which, when combined with the meta-methodology, helps to ensure that all construction/tailoring efforts are sensible – i.e. of measurably good quality. Besides being part of an overall approach, each of these inter-related parts makes its own set of unique, self-contained contributions to the area of secure software engineering. Some of the parts are complete in themselves, while others require elaboration or specialization for different situations. In all cases the frameworks, artefacts and other “tools in the toolkit” can be customized and extended in various ways, providing developers, architects, methodology engineers and other team members with a high degree of freedom and flexibility. The latter point in particular, as well as the whole approach, is demonstrated incrementally throughout the thesis via the engineering of a specific pattern-based security methodology for distributed systems – a case study which in itself is another, final contribution. Of course, the case study methodology is also bigger and better (with respect to its predecessor) and contains novel features, but is only ideal with respect to its project situation. Through the presentation of the parts of the “toolkit” and the illustration of its use, the thesis accomplishes its task of both proposing and demonstrating the value of a comprehensive, holistic approach to engineering security methodologies, thereby offering a solution to the initial problem.Thesis (Ph.D.) -- University of Adelaide, School of Computer Science, 201