Graphical vs. Tabular Notations for Risk Models: On the Role of Textual Labels and Complexity

Abstract

Abstract[Background] Security risk assessment methods in industry mostly use a tabular notation to represent the assessment results whilst academic works advocate graphical methods. Experiments with MSc students showed that the tabular notation is better than an iconic graphical notation for the comprehension of security risks.[Aim] We investigate whether the availability of textual labels and terse UML-style notation could improve comprehensibility. [Method] We report the results of an online comprehensibility experiment involving 61 professionals with an average of 9 years of working experience, in which we compared the ability to comprehend security risk assessments represented in tabular, UML-style with textual labels, and iconic graphical modeling notations.[Results] Tabular notation are still the most comprehensible notion in both recall and precision. However, the presence of textual labels does improve the precision and recall of participants over iconic graphical models.[Conclusion] Tabular representation better supports extraction of correct information of both simple and complex comprehensibility questions about security risks than the graphical notation but textual labels help.

No search allowed

“…There are few significant difference and some similarities between this study and our previous works [23,25] which we summarize in Table 1. The main contribution of this work is studying how well tabular and graphical risk modeling notations support memorization of information about security risks.…”

“…This study showed that supplementing a textual description of security decision problem with graphical representation improves risk perception and participants' confidence in decisions, but does not contribute to the comprehension of the problem or security investment decision. In our prior study [25] we also found that participants achieved better or equal comprehension of described risk scenarios with tabular and UML-based notations.…”

“…The last one contains empirical studies comparing graphical and textual representations for, e.g., business processes [36], software architectures [17], safety and system requirements [9, 42, 44ś46]. Recently, there were published a few empirical studies examining representations for security risks [15,19,25,50] or comparing graphical and tabular methods for security risk assessment in full scale application [22,24,27,30].…”

“…We introduced the memorization task and added UML-like risk modeling notation that combines textual labels with graphical representation. Labunets et al [25] (ESEM'17)…”

“…Previous studies with students and professionals showed that tabular notation supports better extraction of correct information about security risk over the iconic graphical notation [23,25]. However, those finding might not give a full picture and have some limitations of construct validity: the comprehension task could potentially be biased in favor of tabular notations and did not reveal comprehensibility potential of graphical representation.…”