the vulnerabilities that would prevent the system from achieving its goals.
Ian Alexander [178] takes a similar approach of avoiding vulnerabilities, but
relies on misuse cases instead of “anti-goals,” as do G. Sindre and A.L. Opdahl,
[179] while John McDermott [180] substitutes abuse cases for misuse cases. By