# Security Tactic

**In short:** Security tactics are design decisions for protecting a system. They borrow ideas from physical security and fall into four categories. Patterns can realize them, and stakeholders can choose them together.

## Explanation

Security tactics are a way to think about protecting software. The idea comes from physical security. In the physical world, a secure facility lets people reach only certain resources. The same kinds of strategies also make sense for computer-based systems. They lead to four categories of security tactics.

**Tactics and patterns work together.** A pattern is a proven design solution. Researchers who revisited the tactics argue that patterns and tactics complement each other. They are not alternatives. You can use them together, and a pattern can realize a tactic.

**The tactic set has been revised.** The original set of security tactics was refined only once. Researchers have proposed a refined set and a new classification.

**New tactics can come from patterns.** Two ideas appear in the research:

- Split an existing architectural pattern into the tactics it is made of. Use the result to revise the list of security tactics.
- Mine tactics from well-known security patterns instead of inventing them from scratch.

**Stakeholders can choose tactics together.** Security Tactic Planning Poker (SToPPER) is a technique for this. Stakeholders interact with each other and jointly select security tactics. That gives everyone a common basis for using them.

## Example

A team builds an online shop and wants to protect customer accounts. Instead of jumping to a product, they first agree on the kinds of protection they need. They hold a SToPPER-style session with the business owner, the operations lead, and the developers. Together they pick the tactics that matter most. Later, the architects look for patterns that realize those tactics.

## Trade-offs

The sources say the original tactic set was refined only once. Classifications are therefore still being proposed and may change. Tactics also need patterns to become concrete, so choosing tactics is only a first step. Joint selection with stakeholders gives a common basis, but it takes their time.



## Checks

- The document states which security tactics were chosen, rather than only naming security patterns.
- Where a pattern is used, the document says which tactic it realizes.
- The document records that stakeholders took part in selecting the security tactics.

## Related

- [Architectural Tactic](https://arc.fuet.ch/concepts/tactics/architectural-tactic.md)
- [Security](https://arc.fuet.ch/concepts/quality-attributes/security.md)
- [Relationship between Tactics and Architectural Styles/Patterns](https://arc.fuet.ch/concepts/tactics/tactics-vs-architectural-styles-and-patterns.md)
- [Choosing and Applying Tactics](https://arc.fuet.ch/concepts/tactics/choosing-and-applying-tactics.md)
- [Encrypt Data](https://arc.fuet.ch/concepts/tactics/encrypt-data.md)
- [Nonrepudiation](https://arc.fuet.ch/concepts/quality-attributes/nonrepudiation.md)
- [Security Scenario](https://arc.fuet.ch/concepts/quality-attributes/security-scenario.md)
- [Architectural Pattern](https://arc.fuet.ch/concepts/styles-patterns/architectural-pattern.md)

## Sources

- [3.6 Design Concepts to Support Security | Making Design Decisions | InformIT](https://www.informit.com/articles/article.aspx?p=3197432&seqNum=6) — informit.com, accessed 2026-11-09
- [Latin American and Caribbean Consortium of Engineering Institutions](https://laccei.org/LACCEI2014-Guayaquil/RP202.html) — laccei.org, accessed 2026-11-09
- [More Information: Towards the selection of security tactics based on non-functional requirements: Security tactic planning poker :: K.UTB vyhledávací portál | TBU Library Retrieval Portal](https://vufind.katalog.k.utb.cz/SummonRecord/FETCH-LOGICAL-i105t-58c88a68c2967a0821f4e19830480975799017cbcc59fa89dc7112f7dfc9e6833) — vufind.katalog.k.utb.cz, accessed 2026-11-09
- [Revising a security tactics hierarchy through decomposition, reclassification, and derivation - Penn State](https://pure.psu.edu/en/publications/revising-a-security-tactics-hierarchy-through-decomposition-recla/) — pure.psu.edu, accessed 2026-11-09
- [A methodology for mining security tactics from security patterns - Penn State](https://pure.psu.edu/en/publications/a-methodology-for-mining-security-tactics-from-security-patterns/) — pure.psu.edu, accessed 2026-11-09