Visible to the public A Framework to Measure Experts' Decision Making in Security Requirements AnalysisConflict Detection Enabled

TitleA Framework to Measure Experts' Decision Making in Security Requirements Analysis
Publication TypeConference Proceedings
Year of Publication2014
AuthorsHanan Hibshi, Travis Breaux, Maria Riaz, Laurie Williams
Conference Name2014 IEEE 1st International Workshop on Evolving Security and Privacy Requirements Engineering (ESPRE)
Date Published08/2014
Conference LocationKarlskrona, Sweden
KeywordsCMU, decision-making, July'14, patterns, requirements analysis, security, situation awareness

Research shows that commonly accepted security requirements are not generally applied in practice. Instead of relying on requirements checklists, security experts rely on their expertise and background knowledge to identify security vulnerabilities. To understand the gap between available checklists and practice, we conducted a series of interviews to encode the decision-making process of security experts and novices during security requirements analysis. Participants were asked to analyze two types of artifacts: source code, and network diagrams for vulnerabilities and to apply a requirements checklist to mitigate some of those vulnerabilities. We framed our study using Situation Awareness--a cognitive theory from psychology--to elicit responses that we later analyzed using coding theory and grounded analysis. We report our preliminary results of analyzing two interviews that reveal possible decision- making patterns that could characterize how analysts perceive, comprehend and project future threats which leads them to decide upon requirements and their specifications, in addition, to how experts use assumptions to overcome ambiguity in specifications. Our goal is to build a model that researchers can use to evaluate their security requirements methods against how experts transition through different situation awareness levels in their decision-making process.

Citation Keynode-30151

Other available formats:

Hibshi_Framework_TB.pdfPDF document298.3 KBDownloadPreview