Skip to content
Software Architecture Guide

Security Scenario

Explanation

Section titled “Explanation”

A security scenario is a short, concrete story about a security problem. It is one kind of quality attribute scenario (see Quality Attribute Scenario). Security scenarios state how the system reacts when someone tries to breach its security properties.

The six parts

  • Source: who or what starts the scenario.
  • Stimulus: the event the source generates. In a security scenario, this is the attack attempt.
  • Artifact: the part of the system that must respond to the stimulus.
  • Environment: the conditions under which the scenario plays out, such as normal operation.
  • Response: what the system does about the event.
  • Response measure: a quantitative criterion that decides whether the response is good enough.

What the response covers

The response ties back to the three classic security properties:

  • Confidentiality: protection from unauthorized access.
  • Integrity: no unauthorized manipulation of data or services.
  • Availability: the system is there for legitimate use.

Non-repudiation also belongs to security. It means a sender cannot later deny sending a message. The arc42 quality model says security requires at least integrity, availability and non-repudiation.

A response can also include keeping a record of user and system actions. Such an audit record helps trace and identify attackers.

Link to tactics

Security tactics (see Security Tactic) fall into four groups: detect, resist, react and recover. The scenario states the outcome you need. Tactics are the design means to reach it.

Where scenarios are used

arc42 section 10 uses quality scenarios to make quality requirements concrete and measurable. It also credits the same source with the term quality utility tree. arc42 recommends specific, measurable scenarios and lists the response measure as the evaluation criterion.

Example

Section titled “Example”

The arc42 quality catalog contains a pay-rate scenario:

  • Source: a disgruntled employee working remotely.
  • Stimulus: the employee tries to tamper with data.
  • Response: the system blocks the attempt and logs all access attempts in an audit trail. The data is restored if needed.
  • Response measure: the data is restored within one business day.

Trade-offs

Section titled “Trade-offs”

A scenario covers one attack in one situation. You need several scenarios to cover a system’s security. Each scenario is only useful if its response measure is specific and measurable. A vague measure cannot show whether the response was good enough.

Checks

Section titled “Checks”
  • Each security scenario names a source, stimulus, artifact, environment, response and response measure.
  • Each response measure is quantitative, so a reviewer can decide whether the response is good enough.
  • Security scenarios cover at least integrity, availability and non-repudiation.
  • Scenarios that need traceability of attackers include recording of user and system actions.
Section titled “Related”

Sources

Section titled “Sources”