| Title | Mitigating Security Threats Using Tactics and Patterns: A Controlled Experiment |
| Publication Type | Conference Paper |
| Year of Publication | 2016 |
| Authors | Pedraza-García, Gilberto, Noël, René, Matalonga, Santiago, Astudillo, Hernán, Fernandez, Eduardo B. |
| Conference Name | Proccedings of the 10th European Conference on Software Architecture Workshops |
| Publisher | ACM |
| Conference Location | New York, NY, USA |
| ISBN Number | 978-1-4503-4781-5 |
| Keywords | Human Behavior, Metrics, pubcrawl, Resiliency, Scalability, security, security patters, security tactics, software architecture, software architecture security experiment, threat mitigation |
| Abstract | Security Patterns and Architectural Tactics are two well-known techniques for designing secure software systems. There is little or no empirical evidence on their relative effectiveness for security threats mitigation. This study presents MUA (Misuse activities + Patterns), an extension of misuse activities that incorporates patterns, and reports on a controlled comparison of this method that incorporate these techniques for threat mitigation with regard to MAST (Methodology for Applying Security Tactics) which already incorporates tactics. A simple Tsunami Alert System design was analyzed and modified by 40 undergraduate students, and significant difference was found for security threats mitigation (averaging 3.0 for Patterns versus 1.9 for Tactics, in a 1-to-5 scale). This result is contrary to previous results with professional subjects, leading us to believe that novices benefit more of detailed advice than of high-level concepts. |
| URL | http://doi.acm.org/10.1145/2993412.3007552 |
| DOI | 10.1145/2993412.3007552 |
| Citation Key | pedraza-garcia_mitigating_2016 |
Mitigating Security Threats Using Tactics and Patterns: A Controlled Experiment