An Engineering Process and Modelling

This paper presents a novel Security Engineering Process for the creation of security-enhanced system models. The process offers a language for the definition of a domain-specific security knowledge language, the creation of security artefacts using the previous architecture and the use of these artefacts in a system model for fulfilling its security requirements and assurance. It makes security fit naturally in the systems by interleaving security into the initial architecture and system description. The process offers also solutions for the security properties by means of Security Patterns (a new type of patterns developed in the process) and Security Building Blocks. The Security Engineering Process and its Framework has being applied successfully to several and different domains (metering devices, emergency scenarios, set-top boxes, etc.) and is currently being expanded to work with cloud computing scenarios. To illustrate our process we use a mobile command post scenario where we apply the process for the creation of a security-enhanced model.