Decision Support for Choice of Security Solution: The Aspect-Oriented Risk Driven Development (AORDD)Framework

Security critical systems development needs to integrate both project and product risks assessment into the development. Such systems need to balance time to market constraints, cost demands, functional requirement, as well as security requirements. This advocate the use of techniques that support costeffective and risk-driven development. The aspect-oriented risk-driven development (AORDD) framework combines risk-driven development (RDD) with aspect oriented modeling (AOM). Development is incremental, iterative, and risk-driven, and each development cycle ends with a combined project and product risk assessment. The result of the assessment is a list of project and product risks in need of treatment. Cost-effective treatment of risks is handled by the AORDD cost-benefit trade-off analysis. The paper focuses on product risks, and in particular security risks, and provides an overview of the AORDD framework and the AORDD cost-benefit trade-off analysis.