Volume 5 - Issue 3
Genie in a Model? Why Model Driven Security will not secure your Web Application
- Christoph Hochreiner
SBA Research, Austria
chochreiner@sba-research.org
- Peter Fruhwirt
SBA Research, Austria
pfruehwirt@sba-research.org
- Zhendong Ma
Austrian Institute of Technology, Austria
zhendong.ma@ait.ac.at
- Peter Kieseberg
SBA Research, Austria
pkieseberg@sba-research.org
- Sebastian Schrittwieser
St. Polten University of Applied Sciences, Austria
sebastian.schrittwieser@fhstp.ac.at
- Edgar Weippl
SBA Research, Austria
eweippl@sba-research.org
Keywords: model engineering, model driven security, security engineering
Abstract
More often a new software development methodology called Model Driven Engineering (MDE) is
used to increase productivity by supporting powerful code generation tools, which allows a less errorprone
implementation process. However the idea of modeling system aspects during the design phase
- so called Model Driven Security (MDS) - was proposed by the scientific community decades ago
and yet it is still unclear whether MDS can improve the security of a software project. In this paper
we provide a comprehensive evaluation of current MDS approaches based on a web application scenario
in regards to the most common web security attacks. We discuss their strengths and limitations
as well as the practicability of MDS for modern web application security in general.