Security is an important aspect of emerging open systems, such as those in e-commerce and similar applications. Security is, however, often added after the system is already built, and, therefore, many problems may arise from the lack of a systematic consideration of security in the system analysis and design stages, and throughout the whole of system development.

Security patterns have been proposed to encourage such an approach, and to encapsulate best practices in security design, as is the case with software patterns. The main advantage of this paradigm is to address the human factor, which is a main source of errors in building security systems. “A security pattern describes a particular recurring security problem that arises in a specific security context and presents a well-proven generic scheme for a security solution.” For example, there are patterns for access control, passwords, and firewalls.

This book provides an anchor reference for security patterns. The author gained his expertise from planning and organizing the security workshop Hacker Context, and supervising a set of security-related master’s theses.

The book is divided into 10 chapters. These chapters address the need for, and history of, security patterns (chapters 1 through 6), and present the foundations of security patterns, provide a theoretical model, and discuss their main applications (chapters 7 and 8). Chapter 10 reviews previous chapters, by discussing the contribution of each one of these chapters, and concludes the book.

This text was initially a Ph.D. thesis, which was then published in the form of a book. I don’t recommend it for classroom use, but rather as introductory material for people wishing to understand security patterns. I also recommend supplemental material (in the form of a pattern catalog), which I consider a must to complement the book. The pattern catalog is available at http://www.opengroup.org/publications/catalog/g031.htm, and enables system architects and designers to develop security architectures that meet their particular requirements.