Barry is not the weakest link: Eliciting secure system requirements with personas

Proceedings of the 2010 British Computer Society Conference on Human-Computer Interaction, BCS-HCI 2010

Volumn , Issue , 2010, Pages 124-132

  Faily, Shamal ^a   Fléchais, Ivan ^a  

^a UNIVERSITY OF OXFORD   (United Kingdom)

Author keywords

[No Author keywords available]

Indexed keywords

EMPIRICAL DATA; SECURE SYSTEM; USER-CENTERED DESIGN APPROACHES; WEAKEST LINKS;

HUMAN COMPUTER INTERACTION;

EID: 85028943613     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.14236/ewic/hci2010.17     Document Type: Conference Paper

References (31)

1. CAIRIS web site. http://www.comlab.ox.ac.uk/cairis.
2. Adams, A., and Sasse, M. Users are not the enemy. Communications of the ACM 42 (1999), 41–46.
3. Alexander, I. Negative scenarios and misuse cases. In Scenarios, Stories, Use Cases: Through the Systems Development Life-Cycle, I. F. Alexander and N. Maiden, Eds. John Wiley & Sons Ltd, 2004.
4. Aoyama, M. Persona-scenario-goal methodology for user-centered requirements engineering. pp. 185 –194.
5. Baskerville, R. L. Investigating information systems with action research. Commun. AIS (1999), 4.
6. Beyer, H., and Holtzblatt, K. Contextual design: defining customer-centered systems. Morgan Kaufmann Publishers Inc., San Francisco, CA, USA, 1998.
7. Blomquist, A., and Arvola, M. Personas in action: ethnography in an interaction design team. In NordiCHI’02: Proceedings of the second Nordic conference on Human-computer interaction (New York, NY, USA, 2002), ACM, pp. 197–200.
8. Castro, J., Acua, S., and Juristo, N. Integrating the personas technique into the requirements analysis activity. In Computer Science, 2008. ENC’08. Mexican International Conference on (Oct. 2008), pp. 104–112.
9. Cockton, G. Revisiting usability’s three key principles. In CHI’08: CHI’08 extended abstracts on Human factors in computing systems (New York, NY, USA, 2008), ACM, pp. 2473–2484.
10. Cooper, A. The Inmates Are Running the Asylum: Why High Tech Products Drive Us Crazy and How to Restore the Sanity (2nd Edition). Pearson Higher Education, 1999.
11. Cooper, A., Reimann, R., and Cronin, D. About Face 3: The Essentials of Interaction Design. Wiley, 2007.
12. Corbin, J. M., and Strauss, A. L. Basics of qualitative research: techniques and procedures for developing grounded theory, 3rd ed. Sage Publications, Inc., 2008.
13. Elahi, G., and Yu, E. A goal oriented approach for modeling and analyzing security trade-offs, vol. 4801 LNCS. 2007.
14. Faily, S., and Fléchais, I. A Meta-Model for Usable Secure Requirements Engineering. In Software Engineering for Secure Systems, 2010. SESS’10. ICSE Workshop on (May 2010), IEEE Computer Society Press, pp. 126–135.
15. Faily, S., and Fléchais, I. Analysing and Visualising Security and Usability in IRIS. In Availability, Reliability and Security, 2010. ARES 10. Fifth International Conference on (2010).
16. Faily, S., and Fléchais, I. Towards tool-support for Usable Secure Requirements Engineering with CAIRIS. In International Journal of Secure Software Engineering (2010), IGI Global. To Appear.
17. Gould, J. D., and Lewis, C. Designing for usability: key principles and what designers think. Communications of the ACM 28, 3 (1985), 300–311.
18. Holtzblatt, K., and Jones, S. Contextual inquiry: a participatory technique for systems design. In Participatory Design: Principles and Practice, D. Schuler and A. Namioka, Eds. Lawrence Erlbaum Associates, 1993, pp. 177–210.
19. Lamsweerde, A. v. Requirements engineering: from system goals to UML models to software specifications. John Wiley, Hoboken, NJ, 2009.
20. Moundalexis, M., Deery, J., and Roberts, K. Integrating human-computer interaction artifacts into system development, vol. 5619 LNCS. Springer, 2009.
21. Muhr, T. User’s Manual for ATLAS.ti 5.0. ATLAS.ti Scientific Software Development GmbH, Berlin, 2004.
22. Pruitt, J., and Adlin, T. The persona lifecycle: keeping people in mind throughout product design. Elsevier, Amsterdam, 2006.
23. Robertson, J., and Robertson, S. Volere Requirements Specification Template: Edition 14 - January 2009. http://www.volere.co.uk/template.htm, 2009.
24. Saltzer, J., and Schroeder, M. The protection of information in computer systems. Proceedings of the IEEE 63, 9 (Sept. 1975), 1278–1308.
25. Schneier, B. Secrets & Lies: Digital Security in a Networked World. Wiley, 2000.
26. Slay, J., and Miller, M. Lessons learned from the maroochy water breach. In Critical Infrastructure Protection. IFIP WG 11.10 series in critical infrastructure protection, E. Goetz and S. Shenoi, Eds., vol. 253. Springet, 2007, pp. 73–82.
27. Steele, A., and Jie, X. Adversary Centered Design: Threat Modeling Using Anti-Scenarios, Anti-Use Cases and Anti-Personas. In Proceedings of the 2008 International Conference on Information & Knowledge Engineering, IKE 2008 (2008), H. R. Arabnia and R. R. Hashemi, Eds., CSREA Press, pp. 367–370.
28. Van der Linden, M. A. Testing code security. Auerbach Pub, Boca Raton, FL, 2007.
29. van Lamsweerde, A., and Letier, E. Handling obstacles in goal-oriented requirements engineering. Software Engineering, IEEE Transactions on 26, 10 (2000), 978–1005.
30. Whitten, A., and Tygar, J. D. Why Johnny can’t encrypt: a usability evaluation of PGP 5.0. In SSYM’99: Proceedings of the 8th conference on USENIX Security Symposium (Berkeley, CA, USA, 1999), USENIX Association, pp. 14–14.
31. Yu, E. Modeling Strategic Relationships for Process Reengineering. PhD thesis, University of Toronto, 1995.