Using Uml And Security Patterns To Teach Secure Systems Design

Our introductory course on data and network security presents an overview of the main topics of security and has a conceptual and design emphasis. There is a graduate and an undergraduate version of this course. A security course should encompass all the system architectural levels and provide a unifying conceptual approach or it becomes a collection of techniques and mechanisms to solve disjoint problems. For several reasons, formal methods are not appropriate for this purpose. The Unified Modeling Language (UML) is the accepted standard for software development and it is a visual language very appropriate for the description of system architecture. Software patterns are well established for software analysis and design as a way to improve reusability and reliability. We have adopted an approach that combines UML and patterns to present models and mechanisms for security. The students’ reaction to this approach has been very positive because they see the course as a way to learn not only security but also to reinforce their knowledge of object-oriented software design. We are also using this approach in a forthcoming security textbook.