What is a Mitigation Use Case and how does it relate to Misuse Cases?

Question

Accepted Answer

A countermeasure that "mitigates" a Misuse Case (e.g. input validation against an injection attack) — best documented as its own use case, and it becomes a security requirement.
Mitigation Approach:

Identify Misuse Cases (threats)
Create Mitigation Use Cases that counter those threats
Document mitigations either:

As part of the misuse case description, OR
As a separate use case (better approach)

Example:

Misuse Case
Mitigation Use Case

Injection attack
Input validation

Overflow attack
Input validation (bounds checking)

Diagram Notation:

Mitigation Use Cases have a mitigates relationship pointing to the Misuse Case they counter
Often shown in a distinct color (e.g., red outline)

Key Point: Mitigations become security requirements that must be implemented.

Misuse Case	Mitigation Use Case
Injection attack	Input validation
Overflow attack	Input validation (bounds checking)