Evaluating the degree of security of a system built using security patterns

Eduardo B. Fernandez, Nobukazu Yoshioka, Hironori Washizaki

Research output: Chapter in Book/Report/Conference proceedingConference contribution


A variety of methodologies to build secure systems have been proposed. However, most of them do not say much about how to evaluate the degree of security of their products. In fact, we have no generally-accepted ways to measure if the product of some methodology has reached some degree of security. However, if the system has been built with a methodology that uses patterns as artifacts, we believe that a simple evaluation is possible. We propose a metric for the security of systems that have been built using security patterns: We perform threat enumeration, we check if the patterns in the product have stopped the threats, and calculate the coverage of these threats by the patterns. We indicate how to take advantage of the Twin Peaks approach to arrive to a refined measure of security. In early work, we have proposed a secure systems development methodology that uses security patterns and we use it as example.

Original languageEnglish
Title of host publicationARES 2018 - 13th International Conference on Availability, Reliability and Security
PublisherAssociation for Computing Machinery
ISBN (Electronic)9781450364485
Publication statusPublished - 2018 Aug 27
Event13th International Conference on Availability, Reliability and Security, ARES 2018 - Hamburg, Germany
Duration: 2018 Aug 272018 Aug 30

Publication series

NameACM International Conference Proceeding Series


Other13th International Conference on Availability, Reliability and Security, ARES 2018


  • Security evaluation
  • Security patterns
  • Software architecture
  • Software security
  • Systems security

ASJC Scopus subject areas

  • Software
  • Human-Computer Interaction
  • Computer Vision and Pattern Recognition
  • Computer Networks and Communications

Cite this