Abstract
| Original language | Undefined |
|---|---|
| Title of host publication | Proceedings of the 2015 IEEE 2nd Workshop on Evolving Security and Privacy Requirements Engineering (ESPRE) |
| Place of Publication | USA |
| Publisher | IEEE Computer Society |
| Pages | 74-79 |
| Number of pages | 6 |
| ISBN (Print) | 978-1-5090-3694-3 |
| DOIs | |
| Publication status | Published - Sep 2016 |
Publication series
| Name | |
|---|---|
| Publisher | IEEE Computer Society |
Keywords
- EC Grant Agreement nr.: FP7/318003
- EWI-27300
- EC Grant Agreement nr.: FP7/2007-2013
- IR-101750
- METIS-318549
Cite this
}
ArgueSecure: Out-of-the-box Risk Assessment. / Ionita, Dan; Kegel, Roeland Hendrik,Pieter; Wieringa, Roelf J.; Baltuta, Andrei.
Proceedings of the 2015 IEEE 2nd Workshop on Evolving Security and Privacy Requirements Engineering (ESPRE). USA : IEEE Computer Society, 2016. p. 74-79.Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review
TY - GEN
T1 - ArgueSecure: Out-of-the-box Risk Assessment
AU - Ionita, Dan
AU - Kegel, Roeland Hendrik,Pieter
AU - Wieringa, Roelf J.
AU - Baltuta, Andrei
N1 - Foreground = 100% ; Type of activity = Conference; Main leader = UT; Type of audience = Scientific community; Size of audience = 10; Countries addressed = International;
PY - 2016/9
Y1 - 2016/9
N2 - Most established security risk assessment methodologies aim to produce ranked lists of risks. But ranking requires quantification of risks, which in turn relies on data which may not be available or estimations which might not be accurate. As an alternative, we have previously proposed argumentation-based risk assessment. In this paper, based on practitioner feedback, we introduce the latest iteration of this method accompanied by two dedicated tools: an online, collaborative web-portal and an offline version. We focus on the lessons learned in iteratively developing and evaluating these tools and the underlying framework. This new framework -- called ArgueSecure -- focuses on graphically modelling the risk landscape as a collapsible tree. This tree structure intuitively encodes argument traces, therefore maintaining traceability of the results and providing insight into the decision process.
AB - Most established security risk assessment methodologies aim to produce ranked lists of risks. But ranking requires quantification of risks, which in turn relies on data which may not be available or estimations which might not be accurate. As an alternative, we have previously proposed argumentation-based risk assessment. In this paper, based on practitioner feedback, we introduce the latest iteration of this method accompanied by two dedicated tools: an online, collaborative web-portal and an offline version. We focus on the lessons learned in iteratively developing and evaluating these tools and the underlying framework. This new framework -- called ArgueSecure -- focuses on graphically modelling the risk landscape as a collapsible tree. This tree structure intuitively encodes argument traces, therefore maintaining traceability of the results and providing insight into the decision process.
KW - EC Grant Agreement nr.: FP7/318003
KW - EWI-27300
KW - EC Grant Agreement nr.: FP7/2007-2013
KW - IR-101750
KW - METIS-318549
U2 - 10.1109/REW.2016.027
DO - 10.1109/REW.2016.027
M3 - Conference contribution
SN - 978-1-5090-3694-3
SP - 74
EP - 79
BT - Proceedings of the 2015 IEEE 2nd Workshop on Evolving Security and Privacy Requirements Engineering (ESPRE)
PB - IEEE Computer Society
CY - USA
ER -