by Bob Blakley (IBM) and Ian Dobson (The Open Group)
Design of secure systems is a critical, timely, and challenging problem, and there's a clear need for a body of knowledge to guide system architects and programmers, most of whom are not security experts, in the design and implementation of secure systems. A number of security design patterns have been developed and published (see the references below). We would like to aim, in these sessions, to move toward a system of security patterns which can be understood and used as a coherent system to design secure systems from a blank sheet of paper or from existing components. We dould also like, if possible, to incorporate Christoper Alexander's notion (introduced in his series "The Nature of Order") of "generative sequences" in the construction of the security pattern system.
We foresee two kinds of sessions:
Pattern Workshops: The Open Group has produced a draft set of security patterns, including a "protected system" catalog and an "available system" catalog. A selection of these patterns will be workshopped. If you have security patterns under development, we'd be very pleased to consider them as workshop candidates.
Pattern Mining: The organizers are acutely aware that there are large areas of security architecture and design which are not covered by any known patterns. We intend to host several sessions dedicated to identifying the most important gaps in the security pattern literature and identifying candidate patterns and related ideas which may help fill those gaps.
We are aiming for very interactive sessions; we welcome pattern authors and others who have security design experience and a good eye for abstraction to submit patterns, to attend, and to participate actively. The ideal attendee will be an experienced security architect, designer, or programmer who is interested in sharing his or her experience with others, and learning from the group. Participants who have already written some patterns up are especially welcome.
If you're interested in attending this session, please send email to Bob Blakley (blakley@us.ibm.com) and include an summary of the relevant work that you've done.
Some suggested readings:
Books
The Open Group: Guide to Security Patterns (forthcoming; draft available upon request)
Alexander, Christopher: The Nature of Order (volumes 1 and 2)
Web Sites
http://www.ito.tu-darmstadt.de/securitypatterns
Note: PLoP is a trademark of The Hillside Group, Inc.