Sintef Report

Traditional system documentation focuses on the behaviour or functionality we would like the system or application to provide. However, it is equally important to document the undesirable behaviour; what happens when things goes wrong. Moreover, this documentation must be unambiguous and easy to read and understand for the different stakeholders involved. SINTEF has developed a graphical language, the CORAS language for security assessment, allowing undesirable behaviour to be documented in the form of threat scenarios. The CORAS language covers notions like asset, threat, risk and treatment. The objective of this report is to demonstrate the suitability of the CORAS language for modelling threats in relation to: Web Services, ASP.NET, SQL Server, Active Directory and SmartCards.