Skip to main content

Seminar:  Assessment of Risk Perception in Security Requirements Composition

Date:October 26, 2015 
Talk Title:Assessment of Risk Perception in Security Requirements Composition
Speaker:Hanan Hibshi, Ph.D. candidate, Carnegie Mellon University
Time & Location:12:00pm - 1:00pm
DEC, CIC Building, Pittsburgh

Abstract

Security requirements analysis depends on how well-trained analysts perceive security risk, understand the impact of various vulnerabilities, and mitigate threats. When systems are composed of multiple machines, configurations, and software components that interact with each other, risk perception must account for the composition of security requirements. In this paper, we report on how changes to security requirements affect analysts risk perceptions and their decisions about how to modify the requirements to reach adequate security levels. We conducted two user surveys of 174 participants wherein participants assess security levels across 64 factorial vignettes. We analyzed the survey results using multi-level modeling to test for the effect of security requirements composition on participants’ overall security adequacy ratings and on their ratings of individual requirements. We accompanied this analysis with grounded analysis of elicited requirements aimed at lowering the security risk. Our results suggest that requirements composition affects experts’ adequacy ratings on security requirements. In addition, we identified three categories of requirements modifications, called refinements, replacements and reinforcements, and we measured how these categories compare with overall perceived security risk. Finally, we discuss the future impact of our work in security requirements assessment practice.

Speaker Bio

Hanan is a Ph.D student in the Computation, Organizations & Society program at the School of Computer Science at Carnegie Mellon University. In May 2011, she received her Masters degree in Information Security Technology & Management from theInformation Networking Institute (INI) at Carnegie Mellon University. Prior to Hanan's life as a CMU student, she worked as a Teaching Assistant in King Abdul-Aziz University for one year. She had also worked in the banking industry for almost 4 years.