Visuaalselt efektiivsete ja intuitiivsete modelleerimisteadete disainimine turvariski juhtimiseks
Files
Date
2018
Authors
Journal Title
Journal ISSN
Volume Title
Publisher
Abstract
Turvariski juhtimine on toimingute kogum, mille eesmärk on tuvastada ja vähendada turvariske tarkvaraarenduse varastest etappidest alates. Modelleerimisel võivad nii lõppkasutajad kui ka turvaanalüütikud kasutada turvariskidele orienteeritud modelleerimiskeeli. Siiski puudub olemasolevatel keeltel semantiline läbipaistvus, mis tekitab õppimiskõverale täiendavaid takistavaid barjääre ja sügavust. Veelgi enam, hetkel saadaolevad modelleerimiskeeled töötati välja ilma mingit kindlat disaini arvestamata ja nende intuitiivsus on vilets. Kuna modelleerimiskeele oluline tunnusjoon on kognitiivne efektiivsus, keskendub see uuring saadavalolevate turvariskidele orienteeritud modelleerimiskeelte (Secure BPMN, Secure Tropos, Misuse Cases, Mal-activity Diagrams) mõistmise parandamisele. Sellel eesmärgil pakutakse välja ikoonide komplekt, mille võiks integreerida olemasolevatesse modelleerimiskeeltesse. Ikoonide ühtlustatud komplekt suurendaks domeenikohaste kontseptide äratuntavust, mis on toodud infosüsteemide turvariskide juhtimise domeenimudelis, lühendaks õppimiskõverat ning parandaks olemasolevate teadete üldist intuitiivsust. Soovitatav ikoonide komplekt on koostatud mitme empiirilise uuringu põhjal, mis on tehtud kolmes kohas, mis asuvad eri geograafilistes piirkondades ja esindavad erinevaid kultuurilisi taustu. Teadete parandatud kognitiivset efektiivsust, täiendatuna soovitatud ikoonide komplektiga, on kontrollitud hindamisuuringuga, mis näitas olemasolevate teadetega võrreldes paremat mõistmistaset.
Security risk management is a set of activities, aimed at identifying and mitigating security risks starting from the early stages of software development. A set of security risk-oriented modelling languages could be used by both end users and security analysts to perform modelling activities. However, existing languages lack semantical transparency, which re-sults in additional grasping barriers and steepness of learning curve. Moreover, presently available modelling languages were developed with no explicit design rationale in mind and perform poorly in terms of effectiveness and intuitiveness. Since the vital characteris-tic of modelling language is cognitive effectiveness, this research is focused on improving visual perception of the available security risk-oriented modelling languages (Secure BPMN, Secure Tropos, Misuse Cases, Mal-activity Diagrams). This goal is fulfilled by proposing a set of icons, which could be incorporated into existing modelling languages. Unified set of icons would enhance the recognizability of domain-specific concepts, out-lined in Information Systems Security Risk Management Domain Model, as well as reduce the learning curve and improve the overall cognitive efficiency of available notations. Pro-posed icon set is composed based on the outcomes of several empirical studies, performed in 3 distinct locations, belonging to various geographical areas and exhibiting a variety of cultural backgrounds. Improved cognitive effectiveness of notations, augmented with pro-posed icon set, is validated by the conducted evaluation study, which demonstrated in-creased level of comprehension as compared with existing notations.
Security risk management is a set of activities, aimed at identifying and mitigating security risks starting from the early stages of software development. A set of security risk-oriented modelling languages could be used by both end users and security analysts to perform modelling activities. However, existing languages lack semantical transparency, which re-sults in additional grasping barriers and steepness of learning curve. Moreover, presently available modelling languages were developed with no explicit design rationale in mind and perform poorly in terms of effectiveness and intuitiveness. Since the vital characteris-tic of modelling language is cognitive effectiveness, this research is focused on improving visual perception of the available security risk-oriented modelling languages (Secure BPMN, Secure Tropos, Misuse Cases, Mal-activity Diagrams). This goal is fulfilled by proposing a set of icons, which could be incorporated into existing modelling languages. Unified set of icons would enhance the recognizability of domain-specific concepts, out-lined in Information Systems Security Risk Management Domain Model, as well as reduce the learning curve and improve the overall cognitive efficiency of available notations. Pro-posed icon set is composed based on the outcomes of several empirical studies, performed in 3 distinct locations, belonging to various geographical areas and exhibiting a variety of cultural backgrounds. Improved cognitive effectiveness of notations, augmented with pro-posed icon set, is validated by the conducted evaluation study, which demonstrated in-creased level of comprehension as compared with existing notations.