Integrating security and usability into the requirements and design process. (10th May 2007)

• Record Type: Journal Article
• Authors: Flechais, Ivan; Mascolo, Cecilia; Sasse, M. Angela
• Is Part Of: International journal of electronic security and digital forensics. Volume 1:Number 1(2007)
• Page Start: 12
• Page End: 26
• Publication Date: 2007-05-10
• Subjects: electronic security -- usability -- security requirements -- security design -- security modelling -- system design -- information security -- UML metamodelling -- grid computing -- secure software system -- semantics -- e-security; Computer crimes -- Periodicals; Computer crimes -- Investigation -- Periodicals; Computer security -- Periodicals; Electronic commerce -- Law and legislation -- Periodicals; Information warfare -- Periodicals; 005.805
• Languages: English
• ISSNs: 1751-911X

Abstract

According to Ross Anderson, 'Many systems fail because their designers protect the wrong things or protect the right things in the wrong way'. Surveys also show that security incidents in industry are rising, which highlights the difficulty of designing good security. Some recent approaches have targeted security from the technological perspective, others from the humancomputer interaction angle, offering better User Interfaces (UIs) for improved usability of security mechanisms. However, usability issues also extend beyond the user interface and should be considered during system requirements and design. In this paper, we describe Appropriate and Effective Guidance for Information Security (AEGIS), a methodology for the development of secure and usable systems. AEGIS defines a development process and a UML meta-model of the definition and the reasoning over the system's assets. AEGIS has been applied to case studies in the area of Grid computing and we report on one of these.