Shamal Faily
Engaging stakeholders in security design: an assumption-driven approach.
Faily, Shamal
Authors
Contributors
Nathan L. Clarke
Editor
Steven M. Furnell
Editor
Abstract
System stakeholders fail to engage with security until comparatively late in the design and development process. User Experience artefacts like personas and scenarios create this engagement, but creating and contextualising them is difficult without real-world, empirical data; such data cannot be easily elicited from disengaged stakeholders. This paper presents an approach for engaging stakeholders in the elicitation and specification of security requirements at a late-stage of a system's design; this approach relies on assumption-based personas and scenarios, which are aligned with security and requirements analysis activities. We demonstrate this approach by describing how it was used to elicit security requirements for a medical research portal.
Citation
FAILY, S. 2014. Engaging stakeholders in security design: an assumption-driven approach. In Clarke, N.L. and Furnell, S.M. (eds.) Proceedings of the 8th International symposium on human aspects of information security and assurance (HAISA 2014), 8-9 July 2014, Plymouth, UK. Plymouth: Plymouth University, pages 21-29.
Conference Name | 8th International symposium on human aspects of information security and assurance (HAISA 2014) |
---|---|
Conference Location | Plymouth, UK |
Start Date | Jul 8, 2014 |
End Date | Jul 9, 2014 |
Acceptance Date | May 12, 2014 |
Publication Date | Dec 31, 2014 |
Deposit Date | Dec 7, 2021 |
Publicly Available Date | Dec 7, 2021 |
Publisher | University of Plymouth |
Pages | 21-29 |
ISBN | 9781841023755 |
Keywords | Requirements engineering; Software engineering; Systems security; Stakeholder engagement; User personas |
Public URL | https://rgu-repository.worktribe.com/output/1446730 |
Files
FAILY 2014 Engaging stakeholders in security design
(314 Kb)
PDF
Copyright Statement
© Plymouth University
You might also like
Programming language evaluation criteria for safety-critical software in the air domain.
(2022)
Conference Proceeding
Privacy goals for the data lifecycle.
(2022)
Journal Article
Automation and cyber security risks on the railways: the human factors implications.
(2022)
Presentation / Conference
Assessing system of systems information security risk with OASoSIS.
(2022)
Journal Article
Integrated design framework for facilitating systems-theoretic process analysis.
(2022)
Conference Proceeding
Downloadable Citations
About OpenAIR@RGU
Administrator e-mail: publications@rgu.ac.uk
This application uses the following open-source libraries:
SheetJS Community Edition
Apache License Version 2.0 (http://www.apache.org/licenses/)
PDF.js
Apache License Version 2.0 (http://www.apache.org/licenses/)
Font Awesome
SIL OFL 1.1 (http://scripts.sil.org/OFL)
MIT License (http://opensource.org/licenses/mit-license.html)
CC BY 3.0 ( http://creativecommons.org/licenses/by/3.0/)
Powered by Worktribe © 2024
Advanced Search