How do you prioritize security architecture quality attributes?

2 Why prioritize security quality attributes?

Prioritizing security quality attributes is essential for several reasons. First, it helps to identify and focus on the most critical and relevant security aspects of the system, based on the system's purpose, scope, and environment. Second, it helps to balance and manage the trade-offs and conflicts that may arise between different security quality attributes, as well as between security and other quality attributes, such as functionality, usability, reliability, and performance. Third, it helps to communicate and align the security expectations and requirements of the different stakeholders, such as users, customers, developers, testers, managers, and regulators.

3 How to prioritize security quality attributes?

Prioritizing security quality attributes is not a one-size-fits-all endeavor, as each system has its own unique security context and challenges. However, a general and adaptable approach can be summarized in the following steps: first, define the system's security objectives and scope, including security goals, constraints, assumptions, boundaries, risks and threats. Second, identify the relevant security quality attributes and how they relate to the system's security objectives and scope. Third, assign weights or ranks to the security quality attributes by measuring or comparing them using criteria or metrics. Finally, validate and refine the prioritization by involving stakeholders and updating it based on changing security context and requirements.

4 What are some tools and techniques for prioritizing security quality attributes?

Security architects have various tools and techniques at their disposal to prioritize security quality attributes. The Security Quality Attribute Workshop (SQAW) is a collaborative and structured workshop for identifying, analyzing, and prioritizing the security quality attributes of a system through scenarios, questions, and voting techniques. Security Quality Requirement Engineering (SQUARE) is a comprehensive and systematic process for eliciting, categorizing, prioritizing, and documenting the security quality requirements of a system through interviews, surveys, and matrices. To evaluate the security quality attributes of a system objectively and quantitatively, Security Attribute Evaluation Method (SAEM) uses security metrics, benchmarks, and tests. Lastly, Security Quality Attribute Trade-off Analysis (SQATA) is a qualitative and subjective method for analyzing the trade-offs and conflicts between the security quality attributes of a system with diagrams, tables, and ratings.

5 How to apply the prioritization of security quality attributes in practice?

The prioritization of security quality attributes is an ongoing and iterative process that should be embedded in the software development life cycle, from the initial design to the final deployment and maintenance. This prioritization should inform and influence the system's architecture design, implementation and testing, evaluation and review, as well as maintenance and improvement. It should guide the selection and combination of security patterns, principles, and practices that shape the system's architecture. It should also determine the security coding standards, tools, and methods used to implement and test the system's functionality. Additionally, it should provide the criteria and measures used to evaluate and review the system's security level and performance, as well as to identify any security gaps or issues. Finally, it should drive the security monitoring, auditing, and updating activities that are performed to maintain and improve the system's security over time.

6 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?