Engaging stakeholders during late stage security design with assumption personas. (12th October 2015)

• Record Type: Journal Article
• Authors: Faily, Shamal
• Is Part Of: Information and computer security. Volume 23:Number 4(2015)
• Page Start: 435
• Page End: 446
• Publication Date: 2015-10-12
• Subjects: Computer security -- Management -- Periodicals; Computer networks -- Security measures -- Periodicals; Data protection -- Management -- Periodicals; 658.47
• DOI: 10.1108/ICS-10-2014-0066
• Languages: English
• ISSNs: 2056-4961

Abstract

<abstract> <title> <x content-type="archive" xml:space="preserve">Abstract</x> </title> <sec> <title content-type="abstract-heading">Purpose</title> <p> – This paper aims to present an approach where assumption personas are used to engage stakeholders in the elicitation and specification of security requirements at a late stage of a system's design. </p> </sec> <sec> <title content-type="abstract-heading">Design/methodology/approach</title> <p> – The author has devised an approach for developing assumption personas for use in participatory design sessions during the later stages of a system's design. The author validates this approach using a case study in the e-Science domain. </p> </sec> <sec> <title content-type="abstract-heading">Findings</title> <p> – Engagement follows by focusing on the indirect, rather than direct, implications of security. More design approaches are needed for treating security at a comparatively late stage. Security design techniques should scale to working with sub-optimal input data. </p> </sec> <sec> <title content-type="abstract-heading">Originality/value</title> <p> – This paper contributes an approach where assumption personas engage project team members when eliciting and specifying security requirements at the late stages of a project.</p> </sec> </abstract>