UAF Security Views

Security Motivation Sc-Mv

Stakeholders: Security Architects, Security Engineers, Risk Analysts.

Concerns: Security controls, security control families, and overlays.

Definition: Identifies security controls to mitigate against the security risks.

Security Taxonomy Sc-Tx

Stakeholders: Security Architects, Security Engineers.

Concerns: Security assets and security enclaves. [Class] Service [Class] OperationalArchitecture «stereotype» [Class] OperationalMitigation

Definition: Defines the hierarchy of security assets and asset owners that are available to implement security, security constraints (policy, guidance, laws, and regulations) and details where they are located (security enclaves).

Security Structure Sc-Sr

Stakeholders: Security Architects, Security Engineers.

Concerns: The structure of security information and where it is used at the operational and resource level.

Definition: Captures the allocation of assets (operational and resource, information and data) across the security enclaves, shows applicable security controls necessary to protect organizations, systems and information during processing, while in storage (bdd), and during transmission (flows on an ibd). This view also captures Asset Aggregation and allocates the usage of the aggregated information at a location through the use of the information roles.

Security Connectivity Sc-Cn

Stakeholders: Security Architects, Security Engineers.

Concerns: Addresses the security constraints and information assurance attributes that exist on exchanges across resources and across performers.

Definition: Lists security exchanges across security assets; the applicable security controls; and the security enclaves that house the producers and consumers of the exchanges. Measurements can optionally be included.

Security Processes Sc-Pr

Stakeholders: Security Architects, Security Engineers.  

Concerns: The specification of the Security Control families, security controls, and measures required to address a specific security baseline.

Definition: Provides a set of Security Controls and any possible enhancements as applicable to assets. The activity diagram describes operational or resource level processes that apply (operational level) or implement (resource level) security controls/enhancements to assets located in enclaves and across enclaves. This Security Process view can be instantiated either as a variant of an activity/flow diagram or as a hierarchical work breakdown structure.

Security Constraints Sc-Ct

Stakeholders: Security Architects, Security Engineers.

Concerns: Security-related policy, guidance, laws, and regulations as applicable to assets.

Definition: Specifies textual rules/non-functional requirements that are security constraints on resources, information and data (e.g., security-related in the form of rules (e.g., access control policy). A common way of representing access control policy is through the use of XACML (eXtensible Access Control Markup Language), it is expected that implementations of UAF allow users to link security constraints to external files represented in XACML.

Security Traceability Sc-Tr

Stakeholders: Security Architects, Security Engineers, Risk Analysts.

Concerns: Traceability between risk and risk owner, risk mitigations, and affected asset roles.

Definition: Depicts the mapping of a risk to each of the following: risk owner, risk mitigations, and affected asset roles.