Skip to content
Software Architecture Guide

Security Tactic

Explanation

Section titled “Explanation”

Security tactics are a way to think about protecting software. The idea comes from physical security. In the physical world, a secure facility lets people reach only certain resources. The same kinds of strategies also make sense for computer-based systems. They lead to four categories of security tactics.

Tactics and patterns work together. A pattern is a proven design solution. Researchers who revisited the tactics argue that patterns and tactics complement each other. They are not alternatives. You can use them together, and a pattern can realize a tactic.

The tactic set has been revised. The original set of security tactics was refined only once. Researchers have proposed a refined set and a new classification.

New tactics can come from patterns. Two ideas appear in the research:

  • Split an existing architectural pattern into the tactics it is made of. Use the result to revise the list of security tactics.
  • Mine tactics from well-known security patterns instead of inventing them from scratch.

Stakeholders can choose tactics together. Security Tactic Planning Poker (SToPPER) is a technique for this. Stakeholders interact with each other and jointly select security tactics. That gives everyone a common basis for using them.

Example

Section titled “Example”

A team builds an online shop and wants to protect customer accounts. Instead of jumping to a product, they first agree on the kinds of protection they need. They hold a SToPPER-style session with the business owner, the operations lead, and the developers. Together they pick the tactics that matter most. Later, the architects look for patterns that realize those tactics.

Trade-offs

Section titled “Trade-offs”

The sources say the original tactic set was refined only once. Classifications are therefore still being proposed and may change. Tactics also need patterns to become concrete, so choosing tactics is only a first step. Joint selection with stakeholders gives a common basis, but it takes their time.

Checks

Section titled “Checks”
  • The document states which security tactics were chosen, rather than only naming security patterns.
  • Where a pattern is used, the document says which tactic it realizes.
  • The document records that stakeholders took part in selecting the security tactics.
Section titled “Related”

Sources

Section titled “Sources”