Developing Abuse Cases Based on Threat Modeling and Attack Patterns

Abstract

Developing abuse cases help software engineers to think from the perspective of attackers, and therefore allow them to decide and document how the software should react to illegitimate use. This paper describes a method for developing abuse cases based on threat modeling and attack patterns. First potential threats are analyzed by following Microsoft's threat modeling process. Based on the identified threats, initial abuse cases are generated. Attack pattern library is searched and attack patterns relevant to the abuse cases are retrieved. The information retrieved from the attack patterns are used to extend the initial abuse cases and suggest mitigation method. Such a method has the potential to assist software engineers without high expertise in computer security to develop meaningful and useful abuse cases, and therefore reduce the security vulnerabilities in the software systems they develop.

A Method for Developing Abuse Cases and Its Evaluation

“…9) Rank the abuse cases according to their risks. In this method, the new elements that were introduced into the previous work [11] include steps 7 and 9. In this method, the abuse cases generated are ranked according to their risks.…”

“…McGraw [8] suggested that abuse cases be developed based on a set of requirements and standard use cases, and a list of attack patterns. Our previous work proposed a specific process for developing abuse cases based on threat modeling and attack patterns [11]. Such a method intends to allow software developers who do not have high expertise and experience in security to be able to develop meaningful abuse cases.…”

“…Though an example was used to illustrate the use of this method, the effectiveness of this method was not evaluated. This paper describes a method for developing abuse cases that extends the proposed method in [11], and the evaluation of the extended method. This method extends the previous method in the following ways: (a) This method includes ranking the risks of the abuse cases; (2) It incorporates information from Common Weakness Enumeration (CWE) [12] for mitigating the risks of the abuse cases.…”

An Exploratory Study Gathering Security Requirements for the Software Development Process

“…For instance, STRIDE considers that the main attacks could be Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege. The framework can be used to develop abuse stories by identifying potential threats and vulnerabilities in the software system [25].…”