\section{Zooming in on security}

As an example figure~\ref{fig:QNsecurityExample} shows security issues for all the views.
The green (upper) issues are the desired characteristics, specifications and mechanisms.
The red issues are the threats with respect to security. An excellent illustration of the security
example can be found in~\cite{www:SchneierOnSecurity}.

\FigureImposeWidth{QNsecurityExample}{Example security through all views}{.9\textwidth}

\noindent{\it  Customer objectives view}

One of the typical customer objective with respect to security is to keep sensitive information
secure, in other words only a limited set of trusted people has access. The other people
(non trusted) should not be able to see (or worse to alter) this information.

\noindent{\it Application view}

The customer will perform many activities to obtain security: from selecting trustful people
to appointing special guards and administrators who deploy a security policy.
Such a policy will involve classification of people with respect to need
of information and trustfulness and classification of information with
respect to the level of security. To recognize {\it trusted} people authentication
is required by means of badges, passwords and in the future additional biometrics.
Physical security by means of buildings, gates, locks et cetera is also part of the
customers security policy.

The security is threatened in many ways, from burglary to fraud, but also from simple
issues like people forgetting their password and writing it on a yellow sticker.
Social contacts of trusted people can unwillingly expose sensitive information, for instance
two managers discussing business in a business lounge, while the competition is listening
at the next table.

A frequent threat for security is formed by unworkable procedures. For instance the forced
change of passwords every month, resulting in many people writing down the password.

An interesting article is~\cite{www:CarnivalBooth}, which shows how secret security procedures,
in this case for passenger screening at airports, is more vulnerable. It describes a method for
terrorists how to reverse engineer the procedures empirically, which turns the effectiveness of the system
from valuable to dangerous.

\noindent{\it Functional view}

The system under consideration will have to fit in the customers security.
Functions for authentication and adminstration are required.
The performance of the system needs to be expressed explicitly,
for instance the required confidence level of encryption or the speed of authentication.

Security threats are mostly caused by missing functionality or wrong quantification.
This threat will surface in the actual use, where the users will find work around compromising
the security with the work around.

\noindent{\it Conceptual view}

Many techological concepts have been invented to make systems secure, for example
cryptography, firewalls, security zones, authentication, registry, and logging.
Every concept covers a limited set of aspects of security. For instance cryptography
makes stored or transmitted data non-interpretable for non trusted people.

Problems in the conceptual view are mostly due to the non ideal combination of concepts.
For instance cryptography requires keys. Authentication is used to access and validate keys.
The interface between cryptography and authentication is a risky issue. Another risky
issue is the transfer of keys.
All interfaces between the concepts are suspicious areas, where poor design easily
threatens the security.

\noindent{\it Realization view}

The concepts are realized in hardware and software with specific algorithms, interfaces
in specific libraries, running at specific clients and servers et cetera. Every specific
hardware and software element involved in the security concepts in itself must be secure,
in order to have a secure system.

A secure realization is far from trivial. Nearly all systems have bugs. Well known security
related bugs are buffer overflow bugs, which are exploited by hackers to gain access.
Another example is storage of very critical security data, such as passwords and
encryption keys, in non encrypted form. In general exception handling is a source
of security threats in security.

\noindent{\it Security conclusion}

Security is a quality which is heavily determined by the customers way of working
(application view). To enable a security policy of the customer a well designed
and implemented system is required with security functionality fitting in this policy.

In practice the security policy of customers is a large source of problems. Heavy security
features in the system will never solve such a shortcoming. Another common source of
security problems is poor design and implementation, causing a fair policy to be corrupted
by the non secure system.

\FigureImposeWidth{QNsecurityExampleAnnotated}{Role of views}
{.9\textwidth}

Figure~\ref{fig:QNsecurityExampleAnnotated} visualize the reasoning with respect to security
over the different views. Only if sufficient understanding of the context is combined
with good process and design competences an acceptable result can be obtained.

Note that a very much simplified view on security is presented, with the main purpose
of illustration. A real security view will be more extensive than described here.

