Threat Analysis in Goal-Oriented Security Requirements Modelling

Goal and threat modelling are important activities of security requirements engineering: goals express why a system is needed, while threats motivate the need for security. Unfortunately, existing approaches mostly consider goals and threats separately, and thus neglect the mutual influence between them. In this paper, we address this deficiency by proposing an approach that extends goal modelling with threat modelling and analysis. We show that this effort is not trivial and a trade-off between visual expressiveness, usability and usefulness has to be considered. Specifically, we integrate threat modelling with the socio-technical security modelling language (STS-ml), introduce automated analysis techniques that propagate threats in the combined models, and present tool support that enables reuse of threats facilitated by a threat repository. We illustrate our approach on a case study from the Air Traffic Management (ATM) domain, from which we extract some practical challenges. We conclude that threats provide a useful foundation and justification for the security requirements that we derive from goal modelling, but this should not be considered as a replacement to risk assessment. The usage of goals and threats early in the development process allows raising awareness of high-level security issues that occur regardless of the chosen technology and organizational processes.