TRIAD: a framework for survivability architecting

ABSTRACT

High confidence in a system's survivability requires an accurate understanding of the system's threat environment and the impact of that environment on system operations. This paper describes a framework for intrusion-aware design called trustworthy refinement through intrusion-aware design (TRIAD). The spiral structure of TRIAD iterates through three sectors of activity for developing the architectural strategy, for instantiating the architecture using technical components, and for analyzing the impact of the threat environment on system operations. TRIAD helps developers of complex, internetworked information systems to formulate, implement, and maintain a coherent, justifiable, and affordable survivability strategy that addresses mission-compromising threats for their organization. TRIAD facilitates planning for the inevitable change to the threat and operational environment and helps trace the effect of change back to the survivability requirements and architecture.

REFERENCES

• 1: Michael Atighetchi , Partha Pal , Franklin Webber , Christopher Jones, Adaptive Use of Network-Centric Mechanisms in Cyber-Defense, Proceedings of the Sixth IEEE International Symposium on Object-Oriented Real-Time Distributed Computing (ISORC'03), p.183, May 14-16, 2003
• 2: Bachmann, F.; Bass, L.; & Klein, M. Deriving Architectural Tactics: A Step Toward Methodical Architectural Design (CMU/SEI-03-TR-004). Software Engineering Institute, 2003. <http://www.sei.cmu.edu/publications/documents>
• 3: Barry W. Boehm, A Spiral Model of Software Development and Enhancement, Computer, v.21 n.5, p.61-72, May 1988 [doi>10.1109/2.59]
• 4: Ellison R. & Moore, A. Trustworthy Refinement through Intrusion-aware Design (TRIAD) (CMU/SEI-03-TR-002), Software Engineering Institute, 2003. <http://www.sei.cmu.edu/publications/documents>
• 5: Mark W. Maier , Eberhardt Rechtin, The art of systems architecting (2nd ed.), CRC Press, Inc., Boca Raton, FL, 2000
• 6: John Sterman, Business Dynamics, McGraw-Hill, Inc., New York, NY, 2000

INDEX TERMS

Primary Classification:
  D. Software
  D.2 SOFTWARE ENGINEERING
      D.2.1 Requirements/Specifications
          Subjects: Methodologies (e.g., object-oriented, structured)

Additional Classification:
  D. Software
  D.2 SOFTWARE ENGINEERING
        D.2.11 Software Architectures

  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.5 Security and Protection (D.4.6, K.4.2)
          Subjects: Invasive software (e.g., viruses, worms, Trojan horses); Unauthorized access (e.g., hacking, phreaking)

General Terms:
Design, Documentation, Management, Performance, Security

Keywords:
risk analysis, risk management, security, survivability, system architecture, system design, system documentation