Security and Survivability Reasoning Frameworks and Architectural Design Tactics

The Software Engineering Institute (SEI) has been investigating disciplined software architecture design for several years. The SEI approach includes a collection of "quality attribute reasoning frameworks" that understand both quality attribute reasoning and how architects design for the quality attribute under particular situations. The approach was first applied to the quality attributes of modifiability and performance. This report is an initial attempt to use the same method for the related quality attributes of security and survivability. The report includes an initial organization of security within the framework, a partial explication of elements of that framework, and three representative examples of existing security reasoning frameworks.