A UML Profile for the Identification and Analysis of Security Risks during Structured Brainstorming

Methods for identification and analysis of security risks make use of structured brainstorming sessions. The effectiveness of such sessions depends on the extent to which the stakeholders and analysts involved understand and are understood by each other. Since such sessions involve people with different backgrounds and competencies, like users, system-developers, decision makers and system managers, communication among them may be difficult. This report proposes a carefully designed specification language defined as a UML profile aiming to improve communication and understanding during such sessions. We claim that the profile (1) allows the target of evaluation to be described in a uniform manner at a suitable level of abstraction, (2) improves understanding and communication during structured brainstorming sessions concerned with security, (3) facilitates the documentation of results from such brainstorming sessions, and security assessments in general.