Security Patterns

Markus Schumacher, SAP AG, Germany. Eduardo Fernandez-Buglioni, Florida Atlantic University, USA.Duane Hybertson, The MITRE Corp, USA.Frank Buschmann, Siemens AG, Germany.Peter Sommerlad, Hochschule für Technik Rapperswil, Germany.

• Chapter 1 The Pattern Approach 1Patterns at a Glance 2No Pattern is an Island 4Patterns Everywhere 4Humans are the Target 5Patterns Resolve Problems and Shape Environments 6Towards Pattern Languages 7Documenting Patterns 9A Brief Note on The History of Patterns 11The Pattern Community and its Culture 12Chapter 2 Security Foundations 15Overview 16Security Taxonomy 17General Security Resources 26Chapter 3 Security Patterns 29The History of Security Patterns 30Characteristics of Security Patterns 31Why Security Patterns? 34Sources for Security Pattern Mining 37Chapter 4 Patterns Scope and Enterprise Security 47The Scope of Patterns in the Book 48Organization Factors 49Resulting Organization 51Mapping to the Taxonomy 53Organization in the Context of an Enterprise Framework 53Chapter 5 The Security Pattern Landscape 59Enterprise Security and Risk Management Patterns 59Identification & Authentication (I&A) Patterns 62Access Control Model Patterns 67System Access Control Architecture Patterns 69Operating System Access Control Patterns 71Accounting Patterns 73Firewall Architecture Patterns 77Secure Internet Applications Patterns 78Cryptographic Key Management Patterns 80Related Security Pattern Repositories Patterns 83Chapter 6 Enterprise Security and Risk Management 85Security Needs Identification for Enterprise Assets 89Asset Valuation 103Threat Assessment 113Vulnerability Assessment 125Risk Determination 137Enterprise Security Approaches 148Enterprise Security Services 161Enterprise Partner Communication 173Chapter 7 Identification and Authentication (I&A) 187I&A Requirements 192Automated I&A Design Alternatives 207Password Design and Use 217Biometrics Design Alternatives 229Chapter 8 Access Control Models 243Authorization 245Role-Based Access Control 249Multilevel Security 253Reference Monitor 256Role Rights Definition 259Chapter 9 System Access Control Architecture 265Access Control Requirements 267Single Access Point 279Check Point 287Security Session 297Full Access with Errors 305Limited Access 312Chapter 10 Operating System Access Control 321Authenticator 323Controlled Process Creator 328Controlled Object Factory 331Controlled Object Monitor 335Controlled Virtual Address Space 339Execution Domain 343Controlled Execution Environment 346File Authorization 350Chapter 11 Accounting 355Security Accounting Requirements 360Audit Requirements 369Audit Trails and Logging Requirements 378Intrusion Detection Requirements 388Non-Repudiation Requirements 396Chapter 12 Firewall Architectures 403Packet Filter Firewall 405Proxy-Based Firewall 411Stateful Firewall 417Chapter 13 Secure Internet Applications 423Information Obscurity 426Secure Channels 434Known Partners 442Demilitarized Zone 449Protection Reverse Proxy 457Integration Reverse Proxy 465Front Door 473Chapter 14 Case Study: IP Telephony 481IP Telephony at a Glance 482The Fundamentals of IP Telephony 483Vulnerabilities of IP Telephony Components 488IP Telephony Use Cases 488Securing IP telephony with patterns 493Applying Individual Security Patterns 497Conclusion 500Chapter 15 Supplementary Concepts 503Security Principles and Security Patterns 504Enhancing Security Patterns with Misuse Cases 525Chapter 16 Closing Remarks 531References 535Index 555