Using SMCD to Develop Consistent Misuse Case Models: An Industrial Case Study

摘要

Misuse case modeling is a technique that extends the use cases modeling notation to allow the specification of security requirements in a functional form. The consequences of an inconsistent misuse case model can lead to the development of an insecure system, which will likely render it useless in many domains. A number of templates to describe misuse cases. However, none of these templates were designed with a focus to tackle the issue of inconsistency in misuse case models. In a recently published paper in the Journal of Systems and Software, a new structure named Structured Misuse Case Descriptions (SMCD) was proposed to reduce inconsistencies in misuse case models by at least ensuring their structural consistency. In this paper, we report on a successful application of SMCD to a real-world case study. SMCD was used to describe and construct a structurally consistent misuse case model belonging to the system of a Swiss bank.