Skip navigation
User training | Reference and search service

Library catalog

EDS
b-on
More
resources
Content aggregators
Please use this identifier to cite or link to this item:

acessibilidade

http://hdl.handle.net/10071/16410
acessibilidade
Title: The good, the bad and the ugly: a study of security decisions in a cyber-physical systems game
Authors: Frey, S.
Rashid, A.
Anthonysamy, P.
Pinto-Albuquerque, M.
Naqvi, S. A.
Keywords: Security decisions
Security requirements
Game
Decision patterns
Issue Date: 2019
Publisher: IEEE
Abstract: Stakeholders' security decisions play a fundamental role in determining security requirements, yet, little is currently understood about how different stakeholder groups within an organisation approach security and the drivers and tacit biases underpinning their decisions. We studied and contrasted the security decisions of three demographics -- security experts, computer scientists and managers -- when playing a tabletop game that we designed and developed. The game tasks players with managing the security of a cyber-physical environment while facing various threats. Analysis of 12 groups of players (4 groups in each of our demographics) reveals strategies that repeat in particular demographics, e.g., managers and security experts generally favoring technological solutions over personnel training, which computer scientists preferred. Surprisingly, security experts were not ipso facto better players -- in some cases, they made very questionable decisions -- yet they showed a higher level of confidence in themselves. We classified players' decision-making processes, i.e., procedure-, experience-, scenario- or intuition-driven. We identified decision patterns, both good practices and typical errors and pitfalls. Our game provides a requirements sandbox in which players can experiment with security risks, learn about decision-making and its consequences, and reflect on their own perception of security.
Peer reviewed: yes
URI: http://hdl.handle.net/10071/16410
DOI: 10.1109/TSE.2017.2782813
ISSN: 0098-5589
Ciência-IUL: https://ciencia.iscte-iul.pt/id/ci-pub-41810
Appears in Collections:CTI-RI - Artigos em revistas científicas internacionais com arbitragem científica
ISTAR-RI - Artigos em revistas científicas internacionais com arbitragem científica

Files in This Item:
acessibilidade
File Description SizeFormat 
08194898.pdfPós-print4.67 MBAdobe PDFView/Open


FacebookTwitterDeliciousLinkedInDiggGoogle BookmarksMySpace
Formato BibTex MendeleyEndnote Currículo DeGóis 

Items in DSpace are protected by copyright, with all rights reserved, unless otherwise indicated.