Engaging stakeholders in security design: an assumption-driven approach.

Faily, Shamal

Abstract

System stakeholders fail to engage with security until comparatively late in the design and development process. User Experience artefacts like personas and scenarios create this engagement, but creating and contextualising them is difficult without real-world, empirical data; such data cannot be easily elicited from disengaged stakeholders. This paper presents an approach for engaging stakeholders in the elicitation and specification of security requirements at a late-stage of a system's design; this approach relies on assumption-based personas and scenarios, which are aligned with security and requirements analysis activities. We demonstrate this approach by describing how it was used to elicit security requirements for a medical research portal.

Citation

FAILY, S. 2014. Engaging stakeholders in security design: an assumption-driven approach. In Clarke, N.L. and Furnell, S.M. (eds.) Proceedings of the 8th International symposium on human aspects of information security and assurance (HAISA 2014), 8-9 July 2014, Plymouth, UK. Plymouth: Plymouth University, pages 21-29.

• Conference Name: 8th International symposium on human aspects of information security and assurance (HAISA 2014)
• Conference Location: Plymouth, UK
• Start Date: Jul 8, 2014
• End Date: Jul 9, 2014
• Acceptance Date: May 12, 2014
• Publication Date: Dec 31, 2014
• Deposit Date: Dec 7, 2021
• Publicly Available Date: Dec 7, 2021
• Publisher: University of Plymouth
• Pages: 21-29
• ISBN: 9781841023755
• Keywords: Requirements engineering; Software engineering; Systems security; Stakeholder engagement; User personas
• Public URL: https://rgu-repository.worktribe.com/output/1446730