Loading...
Risk and arguments: a risk-based argumentation method for practical security
Date
2011
Abstract
When showing that a software system meets certain security requirements, it is often necessary to work with formal and informal descriptions of the system behavior, vulnerabilities, and the threats from potential attackers. In earlier work, Haley et al. [4] showed structured argumentation could deal with such mixed descriptions. However, incomplete and uncertain information, and limited resources force practitioners to settle for good-enough security. To deal with these conditions of practice, we extend the method of Haley et al. with risk assessment. The proposed method, RISA (RIsk assessment in Security Argumentation), uses public catalogs of security expertise to support the risk assessment, and to guide the security argumentation in identifying rebuttals and mitigations for security requirements satisfaction. We illustrate RISA with a realistic example of PIN entry device.
Supervisor
Description
non-peer-reviewed
Publisher
IEEE Computer Society
Citation
19TH IEEE International Requirements Engineering Conference (RE'11);08/2011
Files
Loading...
2011_Franqueira.pdf
Adobe PDF, 339.39 KB
ULRR Identifiers
Funding code
Funding Information
Science Foundation Ireland (SFI), Secure Change Project Microsoft Software Engineering Innovative Foundation