Building Secure Web Systems Architectures Using Security Patterns

摘要

Software patterns are encapsulated solutions to recurrent problems in a context. Patterns combine experience and good practices to develop basic models that can be used to build new systems, to evaluate existing systems, and as a communication medium for designers. Security patterns provide guidelines for secure system requirements, design, and evaluation. We consider their structure, show a variety of them, and illustrate their use in the construction of secure web-based systems. These patterns include among others Authentication, Authorization/Access Control, Firewalls, Secure Broker, Web Services Security, and Cloud Security patterns. We have built a catalog of over 100 security patterns. We complement these patterns with misuse patterns, which describe how an attack is performed from the point of view of the attacker, we show XSS as an example. We integrate patterns in the form of security reference architectures that represent complete systems. Reference architectures have not been used much in security and we explore their possibilities. We show how to apply these patterns through a secure system development methodology. We introduce patterns in a conceptual way, relating them to their purposes and to the functional parts of the architecture. Example architectures include a browser and a cloud computing system. The use of patterns can provide a holistic view of security, which is a fundamental principle to build secure systems. Patterns can be applied throughout the software lifecycle and provide an ideal communication tool for the builders of the system. They are also useful to record design decisions. The patterns and reference architectures are shown using UML models and examples are taken from my book: "Security patterns in practice: Building secure architectures using software patterns", Wiley Series on Software Design Patterns, 2013. The talk also includes some recent patterns, e.g. Network Function Virtualization. Security is a fundamental quality for any web system. Most proposed solutions are ad hoc or partial; regretfully security must be holistic and systematic. Patterns provide the basis for systematic and holistic approaches and are becoming more important every day. Attendees will be able to understand the idea behind security patterns and security reference architectures, get acquainted with some of them, and use them to build architectures for secure systems.