The full text of this article
Integrating security and usability into the requirements and design process
by Ivan Flechais, Cecilia Mascolo, M. Angela Sasse
International Journal of Electronic Security and Digital Forensics (IJESDF), Vol. 1, No. 1, 2007
Abstract: According to Ross Anderson, 'Many systems fail because their designers protect the wrong things or protect the right things in the wrong way'. Surveys also show that security incidents in industry are rising, which highlights the difficulty of designing good security. Some recent approaches have targeted security from the technological perspective, others from the human–computer interaction angle, offering better User Interfaces (UIs) for improved usability of security mechanisms. However, usability issues also extend beyond the user interface and should be considered during system requirements and design. In this paper, we describe Appropriate and Effective Guidance for Information Security (AEGIS), a methodology for the development of secure and usable systems. AEGIS defines a development process and a UML meta-model of the definition and the reasoning over the system's assets. AEGIS has been applied to case studies in the area of Grid computing and we report on one of these.
Online publication date: Wed, 09-May-2007
is only available to individual subscribers or to users at subscribing institutions.
Go to Inderscience Online Journals to access the Full Text of this article.
Pay per view:
If you are not a subscriber and you just want to read the full contents of this article, buy online access here.
Complimentary Subscribers, Editors or Members of the Editorial Board of the International Journal of Electronic Security and Digital Forensics (IJESDF):
Login with your Inderscience username and password:
Want to subscribe?
A subscription gives you complete access to all articles in the current issue, as well as to all articles in the previous three years (where applicable).
See our Orders page to subscribe.
If you still need assistance, please email email@example.com