Dr. Dallas H Snider

The development of security assurance cases has been touted as one way to improve the security of mission-critical software. However, security assurance cases are not easy to write, communicate, or introduce into the software development process. We describe a two-phase approach to the development of security assurance cases: a first phase in which critical vulnerabilities are identified, and a second phase in which documentation is produced demonstrating that these vulnerabilities have been addressed. Concept maps, an easily understood graphical representation of conceptual knowledge are used to construct the security assurance case. The current work contains a description of a pilot study in the use of this approach.