Reducing the Effort to Comprehend Risk Models: Text Labels Are Often Preferred Over Graphical Means

Abstract

Risk analysis involves people with different roles and competences. The validity of the outcome depends on that they are able to communicate; ideally between themselves, but at least with or via a risk analyst. The CORAS risk modeling language has been developed to facilitate communication between stakeholders involved in the various stages of risk analysis. This article reports the results from an empirical investigation among professionals, where the purpose was to investigate how graphical effects (size, color, shape) and text labels introduced in the CORAS risk modeling language affected the understanding. The results indicate that if graphical effects are used to illustrate important information, they should also be accompanied by informative textual labels.

Graphical vs. Tabular Notations for Risk Models: On the Role of Textual Labels and Complexity

“…Previous studies (Grøndahl et al 2011;Hogganvik and Stølen 2005;Massacci and Paci 2012) give us some confidence that the selected notations are the best ones available at present.…”

“…To the best of our knowledge, there are few similar studies that empirically investigated modeling notations for security risk (Hogganvik and Stølen 2005;Grøndahl et al 2011) or compared graphical and tabular security methods in full scale application experiments (Massacci and Paci 2012;Labunets et al 2013Labunets et al , 2014. Abrahao et al (2013) conducted a large scale study consisted of 5 controlled experiments with 112 participants with different levels of experience to evaluate the effectiveness of dynamic modeling in requirements comprehension.…”

“…Further, the study tested at once correctness and execution time and might be therefore suffer from construct validity. A more recent work (Grøndahl et al 2011) studied the effect of textual labels and graphical icons (size, color, shape of elements) on the comprehension of risk models. The study with 57 IT professionals and students revealed that the participants preferred mixed models that combines textual and graphical representation over the pure graphical representation.…”

Model Comprehension for Security Risk Assessment: An Empirical Comparison of Tabular vs. Graphical Representations

“…Several empirical studies have compared graphical and textual representations for requirements (Sharafi et al 2013;Stålhane and Sindre 2008;Stålhane et al 2010;Stålhane and Sindre 2014), software architectures (Heijstek et al 2011), and business processes (Ottensooser et al 2012). Studies that focus on comparing textual and visual notations for security risk models are less frequent (Hogganvik and Stolen 2005;Grondahl et al 2011) or compared the effectiveness of tabular or graphical methodologies as whole (Massacci and Paci 2012;Labunets et al 2013Labunets et al , 2014b as opposed to the specific aspect of comprehensibility.…”

“…The only difference between the two type of risk models was the presence of graphical CORAS-specific icons. The second work, Grondahl et al (2011) investigated the effect of textual labels and graphical means (size, color, shape of elements) on the comprehension of risk models. The study involved 57 IT professionals and students and shows that some textual information in graphical models is preferred over purely graphical representation.…”