In this chapter, we present the extension UMLsec of UML which allows one to express security-related information within the diagrams in a UML system specification. The extension is given in form of a UML profile using the standard UML extension mechanisms. Stereotypes are used together with tags to formulate security requirements and assumptions on the system environment; constraints give criteria that determine whether the requirements are met by the system design, by referring to the execution semantics. These constraints can be checked automatically using the tool support presented in Chap. 6.

We list requirements on a UML extension for secure systems development and discuss how far our extension meets these requirements. The details of the extension are explained by means of examples. We demonstrate the usefulness of the extension for enforcing established rules of secure systems design and indicate with an example how one could use UMLsec in order to apply security patterns.