Secure System? Challenge Accepted: Finding and Resolving Security Failures Using Security Premortems

Abstract

Risk–driven approaches are dominant in secure systems design; these aim to elicit and treat vulnerabilities and the threats exploiting them. Such approaches, however, are so focused on driving risks out of system design, they fail to recognise the usefulness of failure as a vehicle for security innovation. To explore the role of failure as a design tool, we present the security premortem: a participative design technique where participants assume that a system has been exploited, and plausible reasons are given for explaining why. We describe this approach and illustrate how software tools can be used to support it.

Contributors

Shamal Faily

Simon Parkin

John Lyle

Conference

Publication date: September 2012

Publication date (Print): September 2012

Pages: 1-4

Affiliations

Department of Computer Science

University of Oxford

School of Computer Science

Newcastle University

Article

DOI: 10.14236/ewic/HCI2012.66

Copyright statement: © Shamal Faily et al. Published by BCS Learning and Development Ltd. The 26th BCS Conference on Human Computer Interaction, Birmingham, UK

License:

This work is licensed under a Creative Commons Attribution 4.0 Unported License. To view a copy of this license, visit http://creativecommons.org/licenses/by/4.0/

Conference name: The 26th BCS Conference on Human Computer Interaction

Conference acronym: HCI

Conference number: 26

Conference location: Birmingham, UK

Conference date: 12 - 14 September 2012

Conference sponsor: Electronic Workshops in Computing (eWiC)

Conference theme: Human Computer Interaction

Product

Product Information: 1477-9358BCS Learning & Development

Self URI (article page): https://www.scienceopen.com/hosted-document?doi=10.14236/ewic/HCI2012.66

Self URI (journal page): https://ewic.bcs.org/

Categories

Series title: Electronic Workshops in Computing