Dealing with Security: A Multiple Case Study on Software Architects

While security has long been a significant issue in military systems, the spread of the internet has stimulated a growing interest in, and increasing demand for, secure systems. Understanding how architects manage security requirements in practice is a necessary first step in providing repeatable processes using effective techniques, methods and architectural structures. We present the results of multiple case studies of practicing security architects: key aspects in security requirements, critical issues in managing security requirements, essential characteristics of security architects, the relationship of security with evolution, and problem solving by security architects. We conclude with a lessons learned, and a discussion of related and future research.