Identifying implicit vulnerabilities through personas as goal models

Shamal Faily; Claudia Iacob; Raian Ali; Duncan Ki-Aries

doi:10.1007/978-3-030-64330-0_12

Identifying implicit vulnerabilities through personas as goal models

Shamal Faily^*
, Claudia Iacob
, Raian Ali
, Duncan Ki-Aries

^*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

69 Downloads (Pure)

Abstract

When used in requirements processes and tools, personas have the potential to identify vulnerabilities resulting from misalignment between user expectations and system goals. Typically, however, this potential is unfulfilled as personas and system goals are captured with different mindsets, by different teams, and for different purposes. If personas are visualised as goal models, it may be easier for stakeholders to see implications of their goals being satisfied or denied, and designers to incorporate the creation and analysis of such models into the broader RE tool-chain. This paper outlines a tool-supported approach for finding implicit vulnerabilities from user and system goals by reframing personas as social goal models. We illustrate this approach with a case study where previously hidden vulnerabilities based on human behaviour were identified.

Original language	English
Title of host publication	Computer Security - ESORICS 2020 International Workshops, CyberICPS, SECPRE, and ADIoT, 2020, Revised Selected Papers
Editors	Sokratis Katsikas, Frédéric Cuppens, Nora Cuppens, Costas Lambrinoudakis, Christos Kalloniatis, John Mylopoulos, Annie Antón, Stefanos Gritzalis, Weizhi Meng, Steven Furnell
Publisher	Springer
Pages	185-202
Number of pages	18
ISBN (Electronic)	978-3-030-64330-0
ISBN (Print)	978-3-030-64329-4
DOIs	https://doi.org/10.1007/978-3-030-64330-0_12
Publication status	Published - 17 Dec 2020
Event	6th International Workshop on Security of Industrial Control Systems and Cyber-Physical Systems, CyberICPS 2020, 2nd International Workshop on Security and Privacy Requirements Engineering, SECPRE 2020, and 3rd International Workshop on Attacks and Defenses for Internet-of-Things, ADIoT 2020, held in conjunction with 25th European Symposium on Research in Computer Security, ESORICS 2020 - Guildford, United Kingdom Duration: 14 Sept 2020 → 18 Sept 2020

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	12501 LNCS
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	6th International Workshop on Security of Industrial Control Systems and Cyber-Physical Systems, CyberICPS 2020, 2nd International Workshop on Security and Privacy Requirements Engineering, SECPRE 2020, and 3rd International Workshop on Attacks and Defenses for Internet-of-Things, ADIoT 2020, held in conjunction with 25th European Symposium on Research in Computer Security, ESORICS 2020
Country/Territory	United Kingdom
City	Guildford
Period	14/09/20 → 18/09/20

Access to Document

10.1007/978-3-030-64330-0_12

Faily_et_al_2020_AAM
This is a post-peer-review, pre-copyedit version of an article published in Katsikas S. et al. (eds) Computer Security. CyberICPS 2020, SECPRE 2020, ADIoT 2020. Lecture Notes in Computer Science, vol 12501. Springer, Cham. The final authenticated version is available online at: http://dx.doi.org/10.1007/978-3-030-64330-0_12.
Accepted author manuscript (Post-print), 1.26 MB

http://eprints.bournemouth.ac.uk/34422/

Cite this

Faily, S., Iacob, C., Ali, R., & Ki-Aries, D. (2020). Identifying implicit vulnerabilities through personas as goal models. In S. Katsikas, F. Cuppens, N. Cuppens, C. Lambrinoudakis, C. Kalloniatis, J. Mylopoulos, A. Antón, S. Gritzalis, W. Meng, & S. Furnell (Eds.), Computer Security - ESORICS 2020 International Workshops, CyberICPS, SECPRE, and ADIoT, 2020, Revised Selected Papers (pp. 185-202). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 12501 LNCS). Springer. https://doi.org/10.1007/978-3-030-64330-0_12

Faily, Shamal ; Iacob, Claudia ; Ali, Raian et al. / Identifying implicit vulnerabilities through personas as goal models. Computer Security - ESORICS 2020 International Workshops, CyberICPS, SECPRE, and ADIoT, 2020, Revised Selected Papers. editor / Sokratis Katsikas ; Frédéric Cuppens ; Nora Cuppens ; Costas Lambrinoudakis ; Christos Kalloniatis ; John Mylopoulos ; Annie Antón ; Stefanos Gritzalis ; Weizhi Meng ; Steven Furnell. Springer, 2020. pp. 185-202 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).

@inproceedings{637b75c193644352a5a26a8c22096009,

title = "Identifying implicit vulnerabilities through personas as goal models",

abstract = "When used in requirements processes and tools, personas have the potential to identify vulnerabilities resulting from misalignment between user expectations and system goals. Typically, however, this potential is unfulfilled as personas and system goals are captured with different mindsets, by different teams, and for different purposes. If personas are visualised as goal models, it may be easier for stakeholders to see implications of their goals being satisfied or denied, and designers to incorporate the creation and analysis of such models into the broader RE tool-chain. This paper outlines a tool-supported approach for finding implicit vulnerabilities from user and system goals by reframing personas as social goal models. We illustrate this approach with a case study where previously hidden vulnerabilities based on human behaviour were identified.",

author = "Shamal Faily and Claudia Iacob and Raian Ali and Duncan Ki-Aries",

year = "2020",

month = dec,

day = "17",

doi = "10.1007/978-3-030-64330-0\_12",

language = "English",

isbn = "978-3-030-64329-4",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer",

pages = "185--202",

editor = "Sokratis Katsikas and Fr{\'e}d{\'e}ric Cuppens and Nora Cuppens and Costas Lambrinoudakis and Christos Kalloniatis and John Mylopoulos and Annie Ant{\'o}n and Stefanos Gritzalis and Weizhi Meng and Steven Furnell",

booktitle = "Computer Security - ESORICS 2020 International Workshops, CyberICPS, SECPRE, and ADIoT, 2020, Revised Selected Papers",

address = "Netherlands",

note = "6th International Workshop on Security of Industrial Control Systems and Cyber-Physical Systems, CyberICPS 2020, 2nd International Workshop on Security and Privacy Requirements Engineering, SECPRE 2020, and 3rd International Workshop on Attacks and Defenses for Internet-of-Things, ADIoT 2020, held in conjunction with 25th European Symposium on Research in Computer Security, ESORICS 2020 ; Conference date: 14-09-2020 Through 18-09-2020",

}

Faily, S, Iacob, C, Ali, R & Ki-Aries, D 2020, Identifying implicit vulnerabilities through personas as goal models. in S Katsikas, F Cuppens, N Cuppens, C Lambrinoudakis, C Kalloniatis, J Mylopoulos, A Antón, S Gritzalis, W Meng & S Furnell (eds), Computer Security - ESORICS 2020 International Workshops, CyberICPS, SECPRE, and ADIoT, 2020, Revised Selected Papers. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 12501 LNCS, Springer, pp. 185-202, 6th International Workshop on Security of Industrial Control Systems and Cyber-Physical Systems, CyberICPS 2020, 2nd International Workshop on Security and Privacy Requirements Engineering, SECPRE 2020, and 3rd International Workshop on Attacks and Defenses for Internet-of-Things, ADIoT 2020, held in conjunction with 25th European Symposium on Research in Computer Security, ESORICS 2020, Guildford, United Kingdom, 14/09/20. https://doi.org/10.1007/978-3-030-64330-0_12

Identifying implicit vulnerabilities through personas as goal models. / Faily, Shamal; Iacob, Claudia; Ali, Raian et al.
Computer Security - ESORICS 2020 International Workshops, CyberICPS, SECPRE, and ADIoT, 2020, Revised Selected Papers. ed. / Sokratis Katsikas; Frédéric Cuppens; Nora Cuppens; Costas Lambrinoudakis; Christos Kalloniatis; John Mylopoulos; Annie Antón; Stefanos Gritzalis; Weizhi Meng; Steven Furnell. Springer, 2020. p. 185-202 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 12501 LNCS).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

TY - GEN

T1 - Identifying implicit vulnerabilities through personas as goal models

AU - Faily, Shamal

AU - Iacob, Claudia

AU - Ali, Raian

AU - Ki-Aries, Duncan

PY - 2020/12/17

Y1 - 2020/12/17

N2 - When used in requirements processes and tools, personas have the potential to identify vulnerabilities resulting from misalignment between user expectations and system goals. Typically, however, this potential is unfulfilled as personas and system goals are captured with different mindsets, by different teams, and for different purposes. If personas are visualised as goal models, it may be easier for stakeholders to see implications of their goals being satisfied or denied, and designers to incorporate the creation and analysis of such models into the broader RE tool-chain. This paper outlines a tool-supported approach for finding implicit vulnerabilities from user and system goals by reframing personas as social goal models. We illustrate this approach with a case study where previously hidden vulnerabilities based on human behaviour were identified.

AB - When used in requirements processes and tools, personas have the potential to identify vulnerabilities resulting from misalignment between user expectations and system goals. Typically, however, this potential is unfulfilled as personas and system goals are captured with different mindsets, by different teams, and for different purposes. If personas are visualised as goal models, it may be easier for stakeholders to see implications of their goals being satisfied or denied, and designers to incorporate the creation and analysis of such models into the broader RE tool-chain. This paper outlines a tool-supported approach for finding implicit vulnerabilities from user and system goals by reframing personas as social goal models. We illustrate this approach with a case study where previously hidden vulnerabilities based on human behaviour were identified.

UR - https://www.scopus.com/pages/publications/85098240767

U2 - 10.1007/978-3-030-64330-0_12

DO - 10.1007/978-3-030-64330-0_12

M3 - Conference contribution

AN - SCOPUS:85098240767

SN - 978-3-030-64329-4

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 185

EP - 202

BT - Computer Security - ESORICS 2020 International Workshops, CyberICPS, SECPRE, and ADIoT, 2020, Revised Selected Papers

A2 - Katsikas, Sokratis

A2 - Cuppens, Frédéric

A2 - Cuppens, Nora

A2 - Lambrinoudakis, Costas

A2 - Kalloniatis, Christos

A2 - Mylopoulos, John

A2 - Antón, Annie

A2 - Gritzalis, Stefanos

A2 - Meng, Weizhi

A2 - Furnell, Steven

PB - Springer

T2 - 6th International Workshop on Security of Industrial Control Systems and Cyber-Physical Systems, CyberICPS 2020, 2nd International Workshop on Security and Privacy Requirements Engineering, SECPRE 2020, and 3rd International Workshop on Attacks and Defenses for Internet-of-Things, ADIoT 2020, held in conjunction with 25th European Symposium on Research in Computer Security, ESORICS 2020

Y2 - 14 September 2020 through 18 September 2020

ER -

Faily S, Iacob C, Ali R, Ki-Aries D. Identifying implicit vulnerabilities through personas as goal models. In Katsikas S, Cuppens F, Cuppens N, Lambrinoudakis C, Kalloniatis C, Mylopoulos J, Antón A, Gritzalis S, Meng W, Furnell S, editors, Computer Security - ESORICS 2020 International Workshops, CyberICPS, SECPRE, and ADIoT, 2020, Revised Selected Papers. Springer. 2020. p. 185-202. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-3-030-64330-0_12

Identifying implicit vulnerabilities through personas as goal models

Abstract

Publication series

Conference

Access to Document

Fingerprint

Cite this