Fundamentals software architecture

Unit 09 Assignment 2 Fundamentals of Software Architecture Instructor: Ami Tran Student: Cyril Foday-Kailie Table of Content: 1. Introduction of Management Summary 2. 0Scope and Definition 3. 0Overviews for Requirements and Concerns 4. 0 General Architectural principles 5. 0Views 6.

0Important Scenarios 7. 0Quality Property Summary 8. 0Need to Know Board 9. 0References/appendices . | Date | Version | Comment | | 19th. June 2010 | Draft AD Version 1 Presented by Learner Cyril | AD to be reviewed by Fantasy | | | Foday-Kailie | Stake holders | Content 1Executive Summary1 2Version History1 3Content1 4Purpose2 5Scope3 6Goals, Objectives, and Constraints3 7Architecture Principles3 8Baseline Architecture3 8. 1Business Architecture Models3 8.

2Data Architecture Models3 8. Application Architecture Models3 8. 4Technology Architecture Models3 9Rationale and Justification for Architectural Approach3 10Mapping to Architecture Repository3 10. 1Mapping to Architecture Landscape3 10. 2Mapping to Reference Models3 10. 3Mapping to Standards3 10. 4Re-Use Assessment3 11Target Architecture3 11.

1Business Architecture Models4 11. 2Data Architecture Models4 11. 3Application Architecture Models4 11. 4Technology Architecture Models4 12Gap Analysis4 13Impact Assessment4 Content 1Management Ececutive SummaryThe draft Architectural definition is to clearly reflect detail requirement for the Engineering of a new software Architecture for Fantasy Games that will fulfill the business aim of dominating the market space in Internet sales, generate internet communities that will be able to host meaningful forum by means of chatting, blogging and discussions about current and feature Engineering of Games to reflect the needs of customers and market space. The new System will hold Game Products for worldwide marketing, protect customers privacy and integrate internal an external interfaces that are associated with the system. The document will describe the most efficient and effective means of integrating remote Fantasy Games productive offices in India, Singapore and US locations providing an unhindered but controlled access to productive portal to all it employees and consultants. The document contains define solutions that can convincingly aid validation process to commission the Engineering of the new Architecture.

It will also contain context views and scenarios with relevant perspectives that can establish and enforce the viability of the new system which can be used as n input to begin the SDLC. Scope and Defination The Architecture Definition Document is the deliverable container for the core architectural artifacts created during a project. The Architecture Definition Document ps all architecture domains (business, data, application, andtechnology) and also examines all relevant states of the architecture (baseline, interim state(s), and target). The Architecture Definition Document is a companion to the Architecture Requirements Specification, with a complementary objective: The Architecture Definition Document provides a qualitative view of the solution and aims to communicate the intent of the architects to Stakeholders of Fantasy Games that an adequate an efficient tradeoffs have been implemented as per agreement in various team meeting • The Architecture Requirements Specification provides a quantitative view of the solution, stating measurable criteria that must be met during the implementation of the architecture to build a software system that will host internet sales for Fantasy games and host internet communities that can propose and aid game development. Overview of requirement and ConcernsThe vision of Fantasy Games is to design replacement software architecture in gaming with the ability to cultivate communities. This has been viewed by stakeholders to be a green area of product line that can be principally marketable on the web online. Project Manager of Fantasy Games contracted a consultant architect to design software architecture to reflect the vision and blueprint of the organization in the view of releasing the product within a stipulated timeline as stated by the stakeholders.

The new software will replace existing system and will bring to Fantasy Games new employment realities and extension of the product line. In the view of the stakeholders, Fantasy Games is geared to make history in Gaming as a result of user demands for functional change in their current gaming architecture. The new venture will not only open doors for employment but will appeal to newer gamers’ thereby expanding gaming market of Fantasy games The Proposed Software will host a marketing portal and forum for Gamers and will capture private details and context about it customers. The software will reflect functionality and resilience and it will reflect adaptability with upgrades. The Software Architecture should adhere to the dictates and standards of IEEE 1471. Architectural Perspectives Agile software development has steadily gained momentum and acceptability over the decade as a variable approach of software development and it is a favorable perspective to design Fantasy Games System. This is so as the concept is based on fundamental changes to the essential of software development.

The concept is driven by team work where the aim is to deliver essentials in a timely manner than hoping to have software with many options than huge documentation. In Agile development inputs of the stakeholders become the bases as the final product and is geared to have deliverables as desired by the stake holder using extreme programming (XP) XP is the method of programming that emphasis team work between managers’ customers and developers. These 3 set of people forms an equal partnership to drive the project in a collaborative manner. XP implement a simple but effectiveenvironmentenabling all concern members to achieve solution and maximize productivity. The main idea is that the team rallies around the problem or case for the solution. Such development practice qualifies XP to be an agile method of software development. Citing Don well (1999, 2000, 2001, 2004, 2009) Extreme Programming improves a software project in five essential ways; communication, simplicity, feedback, respect, and courage.

This can be likening as the software architectural process of an agile software designing. These five essentials are to ensure that all necessary objectives are met in software design using Agile method. Team members are treated with respect as the system is made for them not them for the system. The system will courageously be able to respond to change How software architecture process fits into Extreme programming. The software architectural process can be likening to have the same objectives of agile method of programming as compared below. Software architectural process: Capturing stakeholder’s concern/needs: Getting complete picture of what the stake holder requires also helping them resolve conflicts and align their concerns. Making series of Architectural decisions to fulfill stake holders Concern.

This can be regarded as solution to stakeholders concern. Capturing Architectural design decision made. This can be viewed as finding the architectural design that fits the scenario or case. Key Objectives of an agile Architect. Deliver working solutions: Solution to the Business case or the big picture has to be a working or dynamic solution. Maximize stakeholder value: Most times stake holder have differentgoalsas they invest (Time effort andmoney) in to a project Find solutions which meet the goals of all stakeholders: Every solution should be seen as part of the whole picture not as a separate entity Enable the next effort. As the technology and business cases changes, it creates the need for a change in the system Manage change and complexity.

Architect can minimize and mange change to help maximize and preserve stakeholder’s values. There is no simple change a minor change will cost the organization a fortune Drawing parallels between the software architectural process and Agile method:- Capturing stake holders concerns and needs which is the first point in Architectural process can be compared and likening to maximize stakeholders’ value in agile methods. Making architectural decisions to fulfill stake holders’ concerns can be compared to delivering working solution in the agile method. Capturing architectural design can be compared to delivering Working solution, finding solution, enable next effort and manage change and complexities. These made the agile method of XP adhere to standard software architecture process. A context Diagram in AD will define a high level picture of the boundaries and it corresponding external entities of the system. 4.

0 Fig1Project Context Diagram. [pic] Architectural Principles: Architecture principles can be defined as the fundamental assumptions and rules of conduct for the IT organization to create and maintain IT capability. (J. Ryan December 4, 2009) These fundamental rules and conducts serves as organization guide in attaining the Architectural Scopes. You may name them as commandments that are geared to best practice. It is also defined as a fundamental statement of belief, approach, or intent that guides the definition of architecture. It may refer to current circumstances or to a desired future state.

N. Rozanski & E Woods 2005) Achieving maximum enterprise-wide benefit will require changes in the way we plan and manage. Information Technology alone will not bring about this change hence the need for Architectural principles that includes:-. Some stakeholders may have to concede their own preferences for the greater benefit of the entire enterprise. Application development priorities must be established by the entire enterprise for the good of the Business Aim. Applications components should be shared across organizational boundaries. Information management initiatives should be conducted in accordance with the enterprise plan.

Individual organizations should pursue information management initiatives which conform to the blueprints and priorities established by the enterprise. As needs arise, priorities must be adjusted. A forum with comprehensive enterprise representation should make these decisions AD should be well defined and clearly documented to avoid conflict Stake holders should have a reasonable and rational concern. The project should have a budget The project should be driven by the organizationKeep the architecture as simple as possible Constraints: With Fantasy games having a business goal of designing software that can cultivate groups and facilitate Internet marketing could be impacted by many constraints. Project Cost. Project cost is always limited to project budget. Payoff decisions: In other to achieve organizational goals tradeoffs and compromises are made at the cost of forfeiting and enhancing feature of the system.

Standards and principles: Standards and Principles are drivers that limit systems to adhere to mandatory regulation. Client Vendor Dependency: Fantasy Games awarded the software designing contract to a consultant who might not have the necessary skills to build the system to reflect business case. Time: Time is always viewed as moneyprocrastinationdelivery of product will result in loss of demand hence money. Connectivity and Internet service: Due to the dependency on other service providers for connectivity and validation activities. Problem may develop at the end of service provider which is out of the functional control of Fantasy Games. Rouge Activities: With the increase of unethical practices on the web. Web transaction of any sort can be deemed as risky and has to be facilitated with hesitation.

The Architectural team: The architectural team will include all stake holders as listed below CEO: The realization of Organizational goals lies with the CEO who is to lead the project team. CIO: As the most Technological competent staff of the organization. He will be the focal point between organization stakeholder and the architecture. Other Departmental heads: The concern of this group is necessary as the essence of the business goal is to answer their unit level concerns. Investors and Users: An Investor main aim is to maximize profit of his investment whist the user’s goal is to attain efficiency hence they have to be engage to achieve there aim. Programmers and Architect: These are the technical savvy group that makes the logics to come to being. Accountants: Having there concerns as how online transactions are executed with minimum fraud.

Quality Control: They test the quality of the software. Sales and marketing: Group that are tasking with product marketing and publication. Customer services to answer attend to multiple queries that are recoded from Customers at large. Customers: They are the target group for the business case. Views The architect has to identify relevant views to establish the functional aspect of the system or scenario to capture the intended behavior of the system when influenced by different scenarios like external actions induced on the system in the form of client request. The system on the other hand will have to respond to fulfill the functions the system is built to perform. This will assure stakeholders that the baseline functionality requirement of Fantasy Games project is on course.

Overview or functional Scenario: Game Internet based Purchase and download. System State: The system should have baseline information that is capable of running the system without external user action. It may also contain the migrated data from the old system for example previous games. System Environment: Sue will have to ensure that the system deployment environment is working correctly. This may include external and non external systems like servers, SAN, load balancing devices and resources that influence system environment like people. This may include infrastructural behavior like latency. External Stimulus: A definition of what cause the scenario to occur or selected.

User queries and other data transfer or request fall within this scope. E. g. Customer queries the system for a specific Game like for instant Got Green. The system is expected to respond by bringing up similar games that fulfill the criteria got green with a price tag. System Response: The response received when an external stimulus is applied. System is expected to respond when a specific game group is looked up giving a response to the.

Quality based ScenarioSue on the other hand will want the stake holders to know how the quality scenario can work alongside the functional scenarios of Fantasy Games to produce formidable software that is not limited in fulfilling it functional aspect of the software architecture but also provides security, performance, availability and evolution/change or resilience. The quality scenario will enable the software to have it basic security that will be able to protect some aspect of resources that is hosted on the web server and repositories. Overview of Quality based Scenario: How does the system respond when the server hosting the games and community group fails? System environment: The deployment environment includes other expanded resources like wide area application server, Authentication servers, Data / Information bank, credit card processing system hosted sites that can allow customers and gamer community members to access system and their relevant forums. Environmental change: When the primary system gets offline or unavailable, the system will trigger the failover system to give service without the customer knowledge and continue business as usual. Patterns and Styles I will choose functional Scenario as my chosen scenario for Fantasy Games. Dealing with the functional aspect of the software system, it will enable me look at the sequential business process in the software Infrastructure mainly concerning myself with the functionality of the system. It main strength is that it gives me fore knowledge of what business process precede what process which will enable decision as to the relevant style to apply at each phase of the Business Process.

A relevant architectural style to utilize with this Scenario is the Pipe and Filter Style which will be my recommended architectural style to be used in this project. Pipe and Filters and Examples: As defined by Galan & Shaw in Introduction to software Engineering, Example of Pipe and Filters includes Signal processing Domains, Functional programming and distributed System. In a pipe and filter style each component has a set of input and output system, reading streams of data inputs to produce an output. Hence these components are referred to as filters. The connectors of this style serve as conduits for the streams, transmitting outputs of one filter to inputs of another. Hence the connectors are termed “ pipes”. Advantages of Pipe and Filters Among the important invariants of the style, filters must be independent.

Pipe and filters referred to as data flow style allows designers to understand the overall input output of the system and it great advantage of condoning reuse provided they agree on the type of data to be transmitted between them. The ease of maintenance and enhancement by replacing filters is another key reason for the popularity of this style. The ability to permit specialized analysis and support for concurrent operation are some of it versatile actions. The above and some of the main advantages of Pipe and filter style. Disadvantages of Pipe and FiltersIt disadvantages include: – Several batch processes as Pipe and filters treat it processes as independent. They restraint component reuse as each component has to be in agreement of data to be transmitted. Since filters are inherently independent, designers are forced to think of each filter as providing a complete transformation of input data to output data.

The independency of Pipe and filters can lead to loss in performance and increased in complexity. Because of their evolutionary characteristic, pipe and filters are not very ideal in handling interactive systems. Common variant of Pipe and Filter Style: Known for it adaptability with other styles, Pipe and filters are often found compatible with other styles in software development. A variant of this style is the uniform Pipe and Filters found in programs written in UNIX shell, this style adheres to the constraints and laws of Pipe and filters to have same interface. A disadvantage of the uniform interface is that it may reduce network performance if the data needs to be converted to or from its natural format (R, Thomas Fielding 2000) Why was this style chosen? Obviously the selection of architectural style is based on the constraint drawn up in the AD in view to resolve them. The adaptability of Pipe and filters over other styles like object oriented system where output of products sometimes conflict with each other. In general we find that boundaries of styles overlap.

The fact is that like religion every designer has their favorite style which is found workable in the framework system architecture. Hence I feel that the capability and adaptability of Pipe and filters makes it almost applicable to any given scenario in an AD. Quality property summary Through modeling of scenarios and Architectural viewpoint, the architect will be able to establish the functional aspect of the system in the least technical terms. Furthermore, he will be required to model the quality aspect of his architectural design. He will be able to do so by remodeling the quality aspect of the design. Through this model, stakeholders and all concern will be able to see the quality properties of the system as they conform over the function aspect. This includes, security, resilience, evolutionary, redundancy, availability and scalability Sensitive Resources: This table defines sensitive recourses of Fantasy Games.

To secure objects means objects has to be defined and known before necessary security policy is implemented. Resource | Sensitivity | Owner Access | Access Control | | Customer account records | Personal information of value for | Customer Care Group | No direct data access | | | identity theft or invasion of privacy | | | | Descriptive product catalog | Defines what is for sale and its | Stock Management Group | No direct data access | | entries | description; if changed maliciously, | | | | | could harm the business | | | | Pricing product catalog | Defines pricing for catalog items | Pricing Team in Stock | No direct data access | | entries | | Management Group | | | Business operations on customer| Needs to be controlled to protect data | Customer Care Group | Access to individual record or all | | account records | access and integrity | | records by authenticated principal | | Descriptive catalog operations | Needs to be controlled to protect data | Stock Management Group | Access to catalog modification | | | access and integrity | operations by authenticated principal| | Pricing catalog modification | Needs to be controlled to protect data | Pricing Team | Access to price modification | | operations | access and integrity | | operations by authenticated | | | | | principal, withaccountability| In defining what sensitive that needs to be secured is, you will have to determine groups or resource owners in their respective containers. Thus a resource group which contained list of user member will be allowed/denied as per drawn policy for appropriate resource access. This will have to be applicable to all the models that host recourses that client and principal elements of that Fantasy System accesses. Threat Model; | User Elements | User Account Records | Desc. Catalog Records | User Account Operations | Price Change Operations | | Data Administrator | Full Access with Audit | Full Access with Audit | All access with audit | All access with audit | | Catalog manager | None | none | All | Read only | | Unknown webuser | None | None | None | None | | Registered customer | None | None | All on own records | None | The above table is known as the threat model. In a treat model, sensitive resources are identified and required access level security policy implemented through this model.

This will ensure that all resources in the model have adequate security. Due consideration will be given to external and internal attacks on resources by brute force attackers, password guessing attack. Their objective includes breeching user security policy. With adequate security implementation, Fantasy Games resources will be adequately protected as per security perspective implemented across the models Threat Tree: The threat tree is another kind of treat model where the root is the very reason for the attack. The target could be your database, financial or sales information, client credit card information or access to the main security apparatus within the system. The branches are possible means of getting to their objective. These include Social Engineering, key logger, trogon horse, breaking OS Admin password, rouge administrator activities.

To maintain security, proactive measures have to be taken to mitigate attack. Inclusion of a policy of no personal device on the corporate LAN/WAN, no unauthorized software on corporate machines goes a long way in controlling inside treat. Implementation of VLAN and Routers to break broadcast and access list definition and implementation will segment network resources to be available for authorized element and restrict unauthorized accesses. No personal hardware policy will aid identifying social engineering attack devices on the network. Physical access to resource location and devices should be permitted to authorize persons. Above consideration when implemented along with schematics shown in the model perspectives will to a large extent mitigate threats in the infrastructure of Fantasy Games. For E-commerce web services that Fantasy Games provides, all database resources are to be deployed away from the reach of users.

Meaning in the inner networks with multiple firewalls and access list required to build fortress over resources. No Information of user is permitted through web interface. The firewalls that lead to resources will allow traffic only from internal addresses. Only authorized IP’s are allowed to pass-through certain firewall especially those that leads to the sensitive resources. IPS/IDS are vital components to be implemented in securing system infrastructure and they should be strategically placed to prevent and detect security breeches. Since there is no bullet proof network, periodic assessment of the network security is essential to determine thehealthof your network against penetration. Necessary Antivirus and OS upgrade patches should be made available to close venerability point of Applications and OS.

Concurrent Model and Quality Perspective: Aim to secure concurrent system processes of Fantasy Games. The security perspective will ensure that all concurrent client activities inherit appropriate level of security as designed by the security policy server. Firewalls in-between resources can ensure that filtered IP addresses reaches resource. The challenge is latency like all other perspectives. iii. Choice of Software architecture The most ideal Architecture here to be considered is the server client Architecture that will enable all uses regardless of their demography to connect to the main server for services. This Architecture can be represented as below.

Data and software architectural layout: [pic]Web 2. 0 Fig 1. ClientServer Client Server Architecture Using the server/Client Architecture or the two tier approach, the client sends their request through the WAN to reach a relational database for relevant feed back. Static or dynamic structures are used to develop systems, It will be assumed that that client programs are available and that they are further broken down to business logics, databases and development modules on the servers. Due to the utilization of persistent storage and transactional data a relational database will be more ideal. iv. Timeline The whole concept of SDLC is centered on time.

Software development as a project has to be phased into manageable parts to have timely completion. In the project description, a definite timeline should be drawn for project completion. This will guard business concern from been hijacked by competitors. As the saying goes delay is dangerous, procrastination of business process will increase not only cost of production, but exposes the product line to undue competition. These will have an impact on the marketing as users may loose interest. Also a change management once foreseen is best implemented early. Failureto do so may result in the collapse of the existing Architecture.

Also a spontaneous change without proper test may precipitate an unwanted outcome. I have seen where service requests far out weighs the available resource in the system. This may clog the old system if further clients are added. This will cause the system to malfunction which will destroy the mission statement that Fantasy games had established and guarded. Capabilities of the new architecture are expected to create a similar gaming future with further ability of cultivating communities. That is the minimum accepted outcome to refer to the project as successful v. v.

UML Activity Diagram; Unified Modeling language is a collection of values, principles and practice for modeling that can be applicable to software development project (S. W. Ambler 2005-2007). 2. 0 Fig 2. UML highlighting the full development process of software Architecture v v v v > > > v > 3. 0Overview of requirement and concern of Fantasy Games.

i. Role of an Architect: In her/his capacity as the architect, Sue should be aware that the process to achieve project goal and drive can only be possible with collective effort from stakeholders whilst defining the following:-. a. Determine the Business Goals of the Project. Business goal is a specific aim/objective of an organization which is the reason or objective of the existence the project. In the case of Fantasy Games the business goal includes designing new software that can cultivate communities, and facilitate Internet Game Marketing. b.

Determine Architectural scope: Architectural Scope can be seen as a key issues and mile stones that define the system Architecture project development. Defining the Architectural scope of Fantasy Games, the following has to be considered:- bi. The Broad functional areas to be provided by the system: This is the system area of functionality and compatibility across stakeholder groups. Sue will ensure that the software will address concerns of the different office branches that are scattered in 4 countries to concurrently use the system without conflict. Different functional unit is San Diego which includes Account department, Sales and Marketing, Customer Service, IT unit and Quality Assurance are all catered for as documented in the Architectural definition. bii. External Interfaces of the system: Sue will also look into adequate system requirement to facilitate connectivity from all locations to ensure system accessibility, adequate level of access to relational database from Client and users.

Sue will ensure that required external system is in place as indicated. Sue will define if there will be a need to decommission the existing system or a system up gradation of the old system is required. biii. Choosing the preferred architectural design that can deliver business goals of Fantasy Games is an integral process of the project. This can be achieved by tallying the strength and weakness of candidate architecture where decisions can be made by all concern to choose the best out of many. biv. To facilitate Internet community and Internet marketing, a relational database that can hold product catalogue and client details is to be available.

4. 0General Architectural Principles. A context Diagram in AD will define a high level picture of the boundaries and it corresponding external entities of the system. 4. 0 Fig1Project Context Diagram. [pic] 5. 0 Fig 1 [pic] 5.

0 Fig 2 [pic] 5. 0 Fig 3 [pic] 5. 0 Fig 4 [pic] iii. Pipe and Filter diagram representing a functional scenario 5. 0 Fig 5 [pic] Entity Relationship and viewpoints Diagram that adequately represents the Entity relationship of Fantasy Games database that highlights a non technical view of the model for stakeholders’ reviews 5. 0 Fig 6Database Entity Relationship Diagrams. [pic] Legend [pic] Database Entity [pic]Database Attributes [pic]Database Management System Entity[pic]Relationship The Diagram that depict an entity-relationship diagram that shows entities represented in tables, columns, and data types, and shows relationships for the learner’s data model for Next Gen Movies 5.

Fig 7 [pic] Legend [pic]Relationship [pic]Entity [pic]Attributes 5. 0 Fig 8 The UML class diagram that adequately represent the database for Next Gen Movies; [pic] 5. 0 Fig 9 A UML class diagram for the selected organization that data types, and shows relationships for the learner’s data Model for Fantasy Games. [pic] 6. 0 Important Scenarios. These are relevant views the system will exhibit in the form of modeling functional attributes of the system in production for the view of the stake holders. Through this modeling, stake holders will have an idea of how much of their concerns have been captured by the system.

Architectural ModelingThis functional diagram depicts relationship between customer activities and the software system and ERP for Fantasy Games System. The system state will be a functional system with and improvement to generate communities. Product database will be migrated from the existing system that will all client activities like responding to forums which the system can populate as to all it users through the software interface. 6. 0 Fig 1 Functional Diagram [pic] Following diagram shows the infrastructure and database including required hardware and OS and DBMS application to set up and implement the new web application within each of the tiers of Fantasy Games. The system has the provision to allow client external request that can pass through the Fantasy system infrastructure and give require services to the client requestor 6. 0 Fig 2 Development Model.

[pic] 6. 0 Fig 3 Informational Model [pic] Informational Diagram The informational diagram above shows all the main database tables that will be required for the new application to be developed for fantasy Games. It details the web communities and role definition to users and designers alike. It also depict resource the way they are requested by client action and the their interdependencies Concurrency Diagram Below, the concurrency diagram shows how multiple existing activities can be concurrently achieved by the new system of Fantasy Games. 6. 0 Fig 4 Concurrency Diagram [pic] Operational DiagramThe operational view diagram shows the responsible parties for maintaining the data and infrastructure of the new system and depicting the relationship between activities and ERPs. The infrastructure team is responsible for implementing and afterwards maintaining the servers.

The Dbase Admins are responsible for implementing the new DBMS and for maintenance. Sales/Marketing and Client support to handle relevant issues from client that reflect their scope of work. All of these groups of persons will be involved in the projects development and will be considered stakeholders of Fantasy Games System. 6. 0 Fig 5 [pic] 7. Quality property summary. Through modeling of scenerios and Architectural viewpoint, the architect will be able to establish the functional aspect of the system in the least technical terms.

Furthermore, he will be required to model the quality aspect of his architectural design. He will be able to do so by remodeling the quality aspect of the design. Through this model, stakeholders and all concern will be able to see the quality properties of the system as they conform over the function aspect. This includes, security, resilience, evolutionary, redundancy, availability and scalability Sensitive Resources: This table defines sensitive recourses of Fantasy Games. To secure objects means objects has to be defined and known before necessary security policy is implemented. Resource | Sensitivity | Owner Access | Access Control | | Customer account records | Personal information of value for | Customer Care Group | No direct data access | | | identity theft or invasion of privacy | | | | Descriptive product catalog | Defines what is for sale and its | Stock Management Group | No direct data access | | entries | description; if changed maliciously, | | | | | could harm the business | | | | Pricing product catalog | Defines pricing for atalog items | Pricing Team in Stock | No direct data access | | entries | | Management Group | | | Business operations on customer| Needs to be controlled to protect data | Customer Care Group | Access to individual record or all | | account records | access and integrity | | records by authenticated principal | | Descriptive catalog operations | Needs to be controlled to protect data | Stock Management Group | Access to catalog modification | | | access and integrity | | operations by authenticated principal| | Pricing catalog modification | Needs to be controlled to protect data | Pricing Team | Access to price modification | | operations | access and integrity | | operations by authenticated | | | | | principal, with accountability | In defining what sensitive that needs to be secured is, you will have to determine groups or resource owners in their respective containers. Thus a resource group which contained list of user member will be allowed/denied as per drawn policy for appropriate resource access.

This will have to be applicable to all the models that host recourses that client and principal elements of that Fantasy System accesses. i. Threat Model; | User Elements | User Account Records | Desc. Catalog Records | User Account Operations | Price Change Operations | | Data Administrator | Full Access with Audit | Full Access with Audit | All access with audit | All access with audit | | Catalog manager | None | none | All | Read only | | Unknown webuser | None | None | None | None | | Registered customer | None | None | All on own records | None | The above table is known as the threat model. In a treat model, sensitive resources are identified and required access level security policy implemented through this model. This will ensure that all resources in the model have adequate security. Due consideration will be given to external and internal attacks on resources by brute force attackers, password guessing attack.

Their objective includes breeching user security policy. With adequate security implementation, Fantasy Games resources will be adequately protected as per security perspective implemented across the models ii. Threat Tree: The threat tree is another kind of treat model where the root is the very reason for the attack. The target could be your database, financial or sales information, client credit card information or access to the main security apparatus within the system. The branches are possible means of getting to their objective. These include Social Engineering, key logger, trogon horse, breaking OS Admin password, rouge administrator activities. To maintain security, proactive measures have to be taken to mitigate attack.

Inclusion of a policy of no personal device on the corporate LAN/WAN, no unauthorized software on corporate machines goes a long way in controlling inside treat. Implementation of VLAN and Routers to break broadcast and access list definition and implementation will segment network resources to be available for authorized element and restrict unauthorized accesses. No personal hardware policy will aid identifying social engineering attack devices on the network. Physical access to resource location and devices should be permitted to authorize persons. Above consideration when implemented along with schematics shown in the model perspectives will to a large extent mitigate threats in the infrastructure of Fantasy Games. For E-commerce web services that Fantasy Games provides, all database resources are to be deployed away from the reach of users. Meaning in the inner networks with multiple firewalls and access list required to build fortress over resources.

No Information of user is permitted through web interface. The firewalls that lead to resources will allow traffic only from internal addresses. Only authorized IP’s are allowed to pass-through certain firewall especially those that leads to the sensitive resources. IPS/IDS are vital components to be implemented in securing system infrastructure and they should be strategically placed to prevent and detect security breeches. Since there is no bullet proof network, periodic assessment of the network security is essential to determine the health of your network against penetration. Necessary Antivirus and OS upgrade patches should be made available to close venerability point of Applications and OS. Concurrent Model and Quality Perspective: Aim to secure concurrent system processes of Fantasy Games.

The security perspective will ensure that all concurrent client activities inherit appropriate level of security as designed by the security policy server. Firewalls in-between resources can ensure that filtered IP addresses reaches resource. The challenge is latency like all other perspectives. 7. 0 Fig 1 Concurrent perspective [pic] Information model Perspective: Normally, all information perspective does is to reveal object properties. This view is to be kept away at all cost from attacker as it states objects anatomy. It is required by stake holders.

Since Information UML is about information on objects no change is realized when security is implemented as system response is mostly executed in a functional scenario. 7. 0 Fig 2 Informational perspective [pic] Functional Model perspective: Aim to secure process resources with adequate security perspective and required hardware deployed to secure processes, VLANS, IDS/IPS, firewall properly define will secure Fantasy Games System processes and ERP’s ensuring that system state, external stimulus and system response are secured with minimum threat level and vulnerabilities. The impact of the perspective slows the functional process of the system. This is as a result of checks implemented at strategic areas of the process or ERP.. 7.

0 Fig 3 Functional Perspective [pic] . Development Model Perspective: Aim to ensure the Infrastructure of Fantasy Games has adequate multiple point of failure or redundancy in all systems. The hardware, software, repositories, servers, and network devices should have multiple point of failure to minimize system down time. Availability, scalability, and recovery will impact the model with high latency and changes the system state and it response time due to clustering technology and replication. Adding new systems in cluster with their production counterpart will not change the evolutionary properties of the model but assures it availability. Certain aspect of the system can be adequately reused without much strain on the system in event of failure. 7.

0 Fig 4 Development perspective showing redundancy.