Towards a Pattern Language for Security Risk Analysis of Web Applications

This article introduces a pattern language for security risk analysis of web applications in an example driven manner. The example patterns presented include a composite pattern and three basic patterns, namely a security requirements pattern, a web application design pattern and a risk analysis model pattern. The pattern language is intended to be used as a guideline to capture the security risk picture of a web application in a light weighted way with extended user groups, especially in the early phase of the software development life cycle.