Assessing the understandability and acceptance of attack-defense trees for modelling security requirements
Broccia G., Ter Beek M. H., Lluch Lafuente A., Spoletini P., Ferrari A.
Security requirements Attack-Defense Trees Understandability evaluation Empirical user study Method Evaluation Model
Context and Motivation Attack-Defense Trees (ADTs) are a graphical notation used to model and assess security requirements. ADTs are widely popular, as they can facilitate communication between differ-ent stakeholders involved in system security evaluation, and they are for-mal enough to be verified, e.g., with model checkers. Question/Problem While the quality of this notation has been primarily assessed quanti-tatively, its understandability has never been evaluated despite being mentioned as a key factor for its success. Principal idea/Results In this paper, we conduct an experiment with 25 human subjects to assess the understandability and user acceptance of the ADT notation. The study focuses on performance-based variables and perception-based variables, with the aim of evaluating the relationship between these measures and how they might impact the practical use of the notation. The results confirm a good level of understandability of ADTs. Participants consider them useful, and they show intention to use them. Contribution This is the first study empirically supporting the understandability of ADTs, thereby contributing to the theory of security requirements engineering.
Source: LECTURE NOTES IN COMPUTER SCIENCE, vol. 14588, pp. 39-56. Winterthur, Switzerland, April 8–11, 2024
Publisher: Springer
Back to previous page
@inproceedings{oai:iris.cnr.it:20.500.14243/469525,
title = {Assessing the understandability and acceptance of attack-defense trees for modelling security requirements},
author = {Broccia G. and Ter Beek M. H. and Lluch Lafuente A. and Spoletini P. and Ferrari A.},
publisher = {Springer},
booktitle = {LECTURE NOTES IN COMPUTER SCIENCE, vol. 14588, pp. 39-56. Winterthur, Switzerland, April 8–11, 2024},
year = {2024}
}
0000-0002-4737-5761
CODECS
Maximising the CO-benefits of agricultural Digitalisation through conducive digital ECoSystems
Typeful Language Adaptation for Dynamic, Interacting and Evolving Systems
Typeful Language Adaptation for Dynamic, Interacting and Evolving Systems
