Published in

2011 IEEE 19th International Requirements Engineering Conference

DOI: 10.1109/re.2011.6051659

Links

Tools

Export citation

Search in Google Scholar

Risk and Argument: A Risk-based Argumentation Method for Practical Security

Journal article published in 2011 by Virginia N. L. Franqueira, Thein Tan Tun, Yijun Yu, Roel Wieringa, Bashar Nuseibeh ORCID
This paper is available in a repository.
This paper is available in a repository.

Full text: Download

Green circle
Preprint: archiving allowed
Upload
Green circle
Postprint: archiving allowed
Upload
Red circle
Published version: archiving forbidden
Policy details
Data provided by SHERPA/RoMEO

Abstract

When showing that a software system meets certain security requirements, it is often necessary to work with formal and informal descriptions of the system behavior, vulnerabilities, and the threats from potential attackers. In earlier work, Haley et al. [4] showed structured argumentation could deal with such mixed descriptions. However, incomplete and uncertain information, and limited resources force practitioners to settle for good-enough security. To deal with these conditions of practice, we extend the method of Haley et al. with risk assessment. The proposed method, RISA (RIsk assessment in Security Argumentation), uses public catalogs of security expertise to support the risk assessment, and to guide the security argumentation in identifying rebuttals and mitigations for security requirements satisfaction. We illustrate RISA with a realistic example of PIN entry device. ; non-peer-reviewed