Classifying Security Patterns

Analysis and design patterns are well established as a convenient and reusable way to build high-quality object-oriented software. Patterns combine experience and good practices to develop basic models that can be used for new designs. Security patterns join the extensive knowledge accumulated about security with the structure provided by patterns to provide guidelines for secure system design and evaluation. In addition to their value for new system design, security patterns are useful to evaluate existing systems. They are also useful to compare security standards and to verify that products comply with some standard. Finally, we have found security patterns very valuable for teaching security concepts and mechanisms. A variety of security patterns has been developed for the construction of secure systems and catalogs of them are appearing. However, catalogs of patterns are not enough because the designer does not know when ot where to apply them. We discuss here several ways to classify patterns. We show a way to use these classifications through pattern diagrams where a designer can navigate in her pattern selection.