An Experience Repository Supporting Security Risk Analysis

ABSTRACT This paper presents an experience repository aiming to support the reuse of generic aspects of security risk analyses documentation. The generic aspects address three main purposes. They are used to (1) characterize and document the target of evaluation, its context and the assumptions on which the analysis is based, (2) specify undesirable behavior, impacts and scenarios resulting from security breaches and threats, (3) document security risk analysis results. The generic aspects are documented in so-called experience packages. An experience package is either constructive or supportive. A constructive experience package may be instantiated, specialized, extended or adjusted into concrete risk analysis documentation. A supportive experience package, supports the process of documenting by capturing methodological aspects in the form of checklists, patterns, and manual or automated procedures. Each experience package is decomposed into 22 concerns, each of which addressing a specific aspect in the overall security risk management process. Concerns consist of elements, examples of which are UML diagrams, table formats, domains of risk values, or sets of guidewords for structured brainstorming. The repository currently contains 139 elements. The elements have been extracted from major security analyses within e-commerce and telemedicine.