Most security books are targeted at security engineers and specialists. Few show how build security into software. None breakdown the different concerns facing security at different levels of the system: the enterprise, architectural and operational layers. Security Patterns addresses the full spectrum of security in systems design, using best practice solutions to show how to integrate security in the broader engineering process. Essential for designers building large-scale systems who want best practice solutions to typical security problems Real world case studies illustrate how to use the patterns in specific domains For more information visit www.securitypatterns.org

Table of Contents:
Chapter 1 The Pattern Approach 1 Patterns at a Glance 2 No Pattern is an Island 4 Patterns Everywhere 4 Humans are the Target 5 Patterns Resolve Problems and Shape Environments 6 Towards Pattern Languages 7 Documenting Patterns 9 A Brief Note on The History of Patterns 11 The Pattern Community and its Culture 12 Chapter 2 Security Foundations 15 Overview 16 Security Taxonomy 17 General Security Resources 26 Chapter 3 Security Patterns 29 The History of Security Patterns 30 Characteristics of Security Patterns 31 Why Security Patterns? 34 Sources for Security Pattern Mining 37 Chapter 4 Patterns Scope and Enterprise Security 47 The Scope of Patterns in the Book 48 Organization Factors 49 Resulting Organization 51 Mapping to the Taxonomy 53 Organization in the Context of an Enterprise Framework 53 Chapter 5 The Security Pattern Landscape 59 Enterprise Security and Risk Management Patterns 59 Identification & Authentication (I&A) Patterns 62 Access Control Model Patterns 67 System Access Control Architecture Patterns 69 Operating System Access Control Patterns 71 Accounting Patterns 73 Firewall Architecture Patterns 77 Secure Internet Applications Patterns 78 Cryptographic Key Management Patterns 80 Related Security Pattern Repositories Patterns 83 Chapter 6 Enterprise Security and Risk Management 85 Security Needs Identification for Enterprise Assets 89 Asset Valuation 103 Threat Assessment 113 Vulnerability Assessment 125 Risk Determination 137 Enterprise Security Approaches 148 Enterprise Security Services 161 Enterprise Partner Communication 173 Chapter 7 Identification and Authentication (I&A) 187 I&A Requirements 192 Automated I&A Design Alternatives 207 Password Design and Use 217 Biometrics Design Alternatives 229 Chapter 8 Access Control Models 243 Authorization 245 Role-Based Access Control 249 Multilevel Security 253 Reference Monitor 256 Role Rights Definition 259 Chapter 9 System Access Control Architecture 265 Access Control Requirements 267 Single Access Point 279 Check Point 287 Security Session 297 Full Access with Errors 305 Limited Access 312 Chapter 10 Operating System Access Control 321 Authenticator 323 Controlled Process Creator 328 Controlled Object Factory 331 Controlled Object Monitor 335 Controlled Virtual Address Space 339 Execution Domain 343 Controlled Execution Environment 346 File Authorization 350 Chapter 11 Accounting 355 Security Accounting Requirements 360 Audit Requirements 369 Audit Trails and Logging Requirements 378 Intrusion Detection Requirements 388 Non-Repudiation Requirements 396 Chapter 12 Firewall Architectures 403 Packet Filter Firewall 405 Proxy-Based Firewall 411 Stateful Firewall 417 Chapter 13 Secure Internet Applications 423 Information Obscurity 426 Secure Channels 434 Known Partners 442 Demilitarized Zone 449 Protection Reverse Proxy 457 Integration Reverse Proxy 465 Front Door 473 Chapter 14 Case Study: IP Telephony 481 IP Telephony at a Glance 482 The Fundamentals of IP Telephony 483 Vulnerabilities of IP Telephony Components 488 IP Telephony Use Cases 488 Securing IP telephony with patterns 493 Applying Individual Security Patterns 497 Conclusion 500 Chapter 15 Supplementary Concepts 503 Security Principles and Security Patterns 504 Enhancing Security Patterns with Misuse Cases 525 Chapter 16 Closing Remarks 531 References 535 Index 555