Motivating Security Engineering with Economics: A Utility Function Approach

Heitzenrater, Chad; King-Lacroix, Justin; Simpson, Andrew

doi:10.1109/qrs-c.2016.54

Cited by 2 publications

(3 citation statements)

References 19 publications

(33 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A framework rooted in utility theory, decision support and cost-benefit analysis will enable a more systematic and rational planning of software development, and of security overall. Through the inclusion of security investments made during development, the overall security investment is rendered more cost-effective [34], implementation decisions can be made coherently with security concerns [35], and the effectiveness of the overall security enterprise can be analysed [36]. To anchor further discussion, we present a summary of the current state of secure software engineering practice.…”

Section: Paradigmmentioning

confidence: 99%

“…This can be thought of as 'non-functional fit criteria', supplying constraints on the architectural and design decisions through explicit statements related to management concerns such as resources or cost. Preliminary work has demonstrated how such a construct could be used to choose a compliant cryptographic mode that balances functionality and security in order to foster system resilience in Internet of Things (IoT) devices [35]. Expressing security requirements and attacker/defender concerns in this way supports the critical process of refutation [65], and supplies information critical for extending understanding beyond what needs to be protected, to include why.…”

Section: Security In An Economic Contextmentioning

confidence: 99%

“…In addition, re-evaluation and validation of the security expectations throughout the system life-cycle must be supported. While utility theory offers a potential language [35], further validation of this approach on larger and diverse developments is necessary. Application of these techniques must then be balanced with applied engineering experience, and enabled through the development of analytical and specification tools and techniques in order to promote adoption.…”

Section: Directions For the Economics Of Swsecmentioning

confidence: 99%

See 2 more Smart Citations

A case for the economics of secure software development

Heitzenrater

Simpson

2016

Proceedings of the 2016 New Security Paradigms Workshop

Self Cite

View full text Add to dashboard Cite

Over the past 15 years the topic of information security economics has grown to become a large and diverse field, influencing security thinking on issues as diverse as bitcoin markets and cybersecurity insurance. An aspect yet to receive much attention in this respect is that of secure software development, or 'SWSec'-another area that has seen a surge of research since 2000. SWSec provides paradigms, practices and procedures that offer some promise to address current security problems, yet those solutions face financial and technical barriers that necessitate a more thorough approach to planning and execution. Meanwhile, information security economics has developed theory and practice to support a particular world-view; however, it has yet to account for the investments, constructs and benefits of SWSec. As the frequency and severity of computer misuse has increased, both areas have struggled to impart a new mindset for addressing the inherent issues that arise in a diverse, connected and functionality-driven landscape. This paper presents a call for the establishment of an economics of secure software development. We present the primary challenges facing practice, citing relevant literature from both communities to illustrate where commonalities lie-and where further work is needed. Those challenges are decomposed into a research agenda, deriving from the application of principles in both themes a lack of models, representation and analysis in practice. A framework emerges that facilitates discussions of security theory and practice. CCS Concepts •Security and privacy → Economics of security and privacy; Software security engineering; •Software and its engineering → Software design tradeoffs;

show abstract

Section: Paradigmmentioning

confidence: 99%

Section: Security In An Economic Contextmentioning

confidence: 99%

Section: Directions For the Economics Of Swsecmentioning

confidence: 99%

See 1 more Smart Citation