Visible to the public A grounded analysis of experts’ decision-making during security assessmentsConflict Detection Enabled

TitleA grounded analysis of experts’ decision-making during security assessments
Publication TypeJournal Article
Year of Publication2016
AuthorsHanan Hibshi, Travis Breaux, Maria Riaz, Laurie Williams
JournalJournal of Cybersecurity Advance Access
Date Published10/2016
KeywordsCMU, Jan'17, Oct'16, security; requirements; patterns; analysis; decision-making; ysituation awareness
Abstract

Security analysis requires specialized knowledge to align threats and vulnerabilities in information technology. To identify mitigations, analysts need to understand how threats, vulnerabilities, and mitigations are composed together to yield security requirements. Despite abundant guidance in the form of checklists and controls about how to secure systems, evidence suggests that security experts do not apply these checklists. Instead, they rely on their prior knowledge and experience to identify security vulnerabilities. To better understand the different effects of checklists, design analysis, and expertise, we conducted a series of interviews to capture and encode the decisionmaking process of security experts and novices during three security analysis exercises. Participants were asked to analyze three kinds of artifacts: source code, data flow diagrams, and network diagrams, for vulnerabilities, and then to apply a requirements checklist to demonstrate their ability to mitigate vulnerabilities. We framed our study using Situation Awareness, which is a theory about human perception that was used to elicit interviewee responses. The responses were then analyzed using coding theory and grounded analysis. Our results include decision-making patterns that characterize how analysts perceive, comprehend, and project future threats against a system, and how these patterns relate to selecting security mitigations. Based on this analysis, we discovered new theory to measure how security experts and novices apply attack models and how structured and unstructured analysis enables increasing security requirements coverage. We highlight the role of expertise level and requirements composition in affecting security decision-making and we discuss how our method produced new hypotheses about security analysis and decisionmaking.

DOI10.1093/cybsec/tyw010
Citation Keynode-30205

Other available formats:

Hibshi_Grounded_Analysis_TB.pdf
AttachmentSize
bytes