Integrating security and usability into the requirements and design process

被引：31
作者：
Flechais, Ivan [1 ]
Mascolo, Cecilia [2 ]
Sasse, M. Angela [2 ]
机构：
[1] Univ Oxford, Comp Lab, Wolfson Bldg, Oxford OX1 3QD, England
[2] UCL, Dept Comp Sci, London WC1E 6BT, England
来源：
INTERNATIONAL JOURNAL OF ELECTRONIC SECURITY AND DIGITAL FORENSICS | 2007年 / 1卷 / 01期
关键词：
security; usability; security requirements; security design; security modelling;
D O I：
10.1504/IJESDF.2007.013589
中图分类号：
TP [自动化技术、计算机技术];
学科分类号：
0812 ;
摘要：
According to Ross Anderson, 'Many systems fail because their designers protect the wrong things or protect the right things in the wrong way'. Surveys also show that security incidents in industry are rising, which highlights the difficulty of designing good security. Some recent approaches have targeted security from the technological perspective, others from the human-computer interaction angle, offering better User Interfaces (UIs) for improved usability of security mechanisms. However, usability issues also extend beyond the user interface and should be considered during system requirements and design. In this paper, we describe Appropriate and Effective Guidance for Information Security (AEGIS), a methodology for the development of secure and usable systems. AEGIS defines a development process and a UML meta-model of the definition and the reasoning over the system's assets. AEGIS has been applied to case studies in the area of Grid computing and we report on one of these.
引用
收藏
页码：12 / 26
页数：15
相关论文
共 20 条
  • [1] [Anonymous], 2003, UN MOD LANG VERS 1 5
  • [2] Beyer H., 1998, CONTEXTUAL DESIGN DE
  • [3] BOEHM BW, 1988, COMPUTER, V21, P61, DOI 10.1145/12944.12948
  • [4] Gollman D, 2013, COMPUTER SECURITY
  • [5] Guerra PAD, 2003, LECT NOTES COMPUT SC, V2677, P129
  • [6] McDermott J., 1999, P 15 ANN COMP SEC AP
  • [7] Mumford E., 1983, DESIGNING HUMAN SYST
  • [8] Object Management Group, 2003, TECHNICAL REPORT
  • [9] Schneier Bruce, 2003, FEAR THINKING SENSIB
  • [10] Coping with systems risk: Security planning models for management decision making
    Straub, DW
    Welke, RJ
    [J]. MIS QUARTERLY, 1998, 22 (04) : 441 - 469
12