Visible to the public Biblio

Filters: Keyword is Natural languages  [Clear All Filters]
2017-11-20
Rudolph, M., Moucha, C., Feth, D..  2016.  A Framework for Generating User-and Domain-Tailored Security Policy Editors. 2016 IEEE 24th International Requirements Engineering Conference Workshops (REW). :56–61.

In modern enterprises, incorrect or inconsistent security policies can lead to massive damage, e.g., through unintended data leakage. As policy authors have different skills and background knowledge, usable policy editors have to be tailored to the author's individual needs and to the corresponding application domain. However, the development of individual policy editors and the customization of existing ones is an effort consuming task. In this paper, we present a framework for generating tailored policy editors. In order to empower user-friendly and less error-prone specification of security policies, the framework supports multiple platforms, policy languages, and specification paradigms.

Buthelezi, M. P., Poll, J. A. van der, Ochola, E. O..  2016.  Ambiguity as a Barrier to Information Security Policy Compliance: A Content Analysis. 2016 International Conference on Computational Science and Computational Intelligence (CSCI). :1360–1367.

Institutions use the information security (InfoSec) policy document as a set of rules and guidelines to govern the use of the institutional information resources. However, a common problem is that these policies are often not followed or complied with. This study explores the extent to which the problem lies with the policy documents themselves. The InfoSec policies are documented in the natural languages, which are prone to ambiguity and misinterpretation. Subsequently such policies may be ambiguous, thereby making it hard, if not impossible for users to comply with. A case study approach with a content analysis was conducted. The research explores the extent of the problem by using a case study of an educational institution in South Africa.

2014-10-24
Breaux, T.D., Hibshi, H., Rao, A, Lehker, J..  2012.  Towards a framework for pattern experimentation: Understanding empirical validity in requirements engineering patterns. Requirements Patterns (RePa), 2012 IEEE Second International Workshop on. :41-47.

Despite the abundance of information security guidelines, system developers have difficulties implementing technical solutions that are reasonably secure. Security patterns are one possible solution to help developers reuse security knowledge. The challenge is that it takes experts to develop security patterns. To address this challenge, we need a framework to identify and assess patterns and pattern application practices that are accessible to non-experts. In this paper, we narrowly define what we mean by patterns by focusing on requirements patterns and the considerations that may inform how we identify and validate patterns for knowledge reuse. We motivate this discussion using examples from the requirements pattern literature and theory in cognitive psychology.