Information models and the application life cycle
An information model (e.g., schema) that can incorporate expertise into an application engineering activity—for example, a threats and countermeasures schema can be applied to a threat modeling component to converge knowledge into the activity by identifying categories, vulnerabilities, attacks and countermeasures. The novel schema can create a common framework that converges knowledge with respect to any application engineering activity (e.g., threat modeling, performance modeling). For example, the framework can include lists of threats and attacks that can be acted upon. As well, the framework can include a list of countermeasures based upon the attacks. Additionally, a context precision mechanism can be employed to automatically and/or dynamically determine a context of an application environment. This context can be used to automatically generate an appropriate schema or information model.
1 . A system that facilitates engineering of an application, comprising:
an information model configuration component that incorporates engineering expertise into an information model; and
an application engineering component that executes an engineering activity based at least in part upon the information model.
2 . The system of claim 1 , the information model comprises:
a category identifier;
a vulnerability identifier;
an attack identifier; and
a countermeasure identifier.
3 . The system of claim 1 , the engineering activity is at least one of a security objective definition, a threat modeling, a code review and a deployment review activity.
4 . The system of claim 1 , further comprising a context precision component that analyzes the application and establishes a context; the information model is based at least in part upon the context.
5 . The system of claim 4 , the context defines at least one of an application type, a project type, and a life cycle type.
6 . The system of claim 1 , the information model defines an input validation system.
7 . The system of claim 6 , the input validation system includes a constrain component that filters good data.
8 . The system of claim 7 , the input validation system further comprises a reject component that rejects bad data.
9 . The system of claim 8 , the input validation system further comprises a sanitize component that cleanses the bad data.
10 . The system of claim 1 , further comprising an artificial intelligence (AI) component that infers an action that a user desires to be automatically performed.
11 . A computer-implemented method of engineering an application, comprising:
generating a schema; and
executing an application engineering activity based at least in part upon the schema.
12 . The computer-implemented method of claim 11 , further comprising determining a context of the application and incorporating the context into the act of generating the schema.
13 . The computer-implemented method of claim 12 , the context includes at least one of an application type, a project type and a life cycle type.
14 . The computer-implemented method of claim 11 , schema comprises:
a category identifier;
a vulnerability identifier;
an attack identifier; and
a countermeasure identifier.
15 . The computer-implemented method of claim 11 , the schema defines at least one of a data validation system, an authentication system, an authorization system, a configuration management system, a session management system and an auditing and logging system.
16 . A computer-executable system that facilitates engineering of an application, comprising:
means for identifying a context of the application;
means for converging knowledge based at least in part upon the context; and
means for performing an application engineering activity based at least in part upon the knowledge.
17 . The computer-executable system of claim 16 , the means for converging knowledge is a template.
18 . The computer-executable system of claim 17 , the means for identifying the context is a context precision component.
19 . The computer-executable system of claim 18 , the engineering activity is a threat modeling activity.
20 . The computer-executable system of claim 18 , the engineering activity is a performance modeling activity.