An Anti-Pattern for Misuse Cases

Mohammad Torabi Dashti; Saša Radomirović

doi:10.1007/978-3-319-72817-9_16

An Anti-Pattern for Misuse Cases

Mohammad Torabi Dashti, Saša Radomirović

Computing

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

378 Downloads (Pure)

Abstract

Misuse case analysis is a method for the elicitation, documentation, and communication of security requirements. It builds upon the well-established use case analysis method and is one of the few existing techniques dedicated to security requirements engineering. We present an anti-pattern for applying misuse cases, dubbed “orphan misuses.” Orphan misuse cases by and large ignore the system at hand, thus providing little insight into its security. Common symptoms include implementation-dependent threats and overly general, vacuous mitigations. We illustrate orphan misuse cases through examples, explain their negative consequences in detail, and give guidelines for avoiding them.

Original language	English
Title of host publication	Computer Security - ESORICS 2017 International Workshops, CyberICPS 2017 and SECPRE 2017, Revised Selected Papers
Subtitle of host publication	ESORICS 2017 International Workshops, CyberICPS 2017 and SECPRE 2017, Oslo, Norway, September 14-15, 2017, Revised Selected Papers
Editors	Sokratis K. Katsikas, Frederic Cuppens, Nora Cuppens, Costas Lambrinodakis, Christos Kalloniatis, John Mylopoulos, Annie Anton, Stefanos Gritzalis
Place of Publication	Switzerland
Publisher	Springer
Pages	250-261
Number of pages	12
Volume	10683
ISBN (Electronic)	9783319728179
ISBN (Print)	9783319728162
DOIs	https://doi.org/10.1007/978-3-319-72817-9_16
Publication status	Published - 2018
Event	1st International Workshop on SECurity and Privacy Requirements Engineering - Gamle museet / The old museum, Oslo, Norway Duration: 14 Sept 2017 → 15 Sept 2017 https://samosweb.aegean.gr/secpre2017/

Publication series

Name	Lecture Notes in Computer Science
Volume	10683
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	1st International Workshop on SECurity and Privacy Requirements Engineering
Abbreviated title	SECPRE 2017
Country/Territory	Norway
City	Oslo
Period	14/09/17 → 15/09/17
Internet address	https://samosweb.aegean.gr/secpre2017/

ASJC Scopus subject areas

Theoretical Computer Science
General Computer Science

Access to Document

10.1007/978-3-319-72817-9_16

Author Accepted ManuscriptAccepted author manuscript, 330 KB

Cite this

Dashti, M. T., & Radomirović, S. (2018). An Anti-Pattern for Misuse Cases. In S. K. Katsikas, F. Cuppens, N. Cuppens, C. Lambrinodakis, C. Kalloniatis, J. Mylopoulos, A. Anton, & S. Gritzalis (Eds.), Computer Security - ESORICS 2017 International Workshops, CyberICPS 2017 and SECPRE 2017, Revised Selected Papers: ESORICS 2017 International Workshops, CyberICPS 2017 and SECPRE 2017, Oslo, Norway, September 14-15, 2017, Revised Selected Papers (Vol. 10683, pp. 250-261). (Lecture Notes in Computer Science; Vol. 10683). Springer . https://doi.org/10.1007/978-3-319-72817-9_16

Dashti, Mohammad Torabi ; Radomirović, Saša. / An Anti-Pattern for Misuse Cases. Computer Security - ESORICS 2017 International Workshops, CyberICPS 2017 and SECPRE 2017, Revised Selected Papers: ESORICS 2017 International Workshops, CyberICPS 2017 and SECPRE 2017, Oslo, Norway, September 14-15, 2017, Revised Selected Papers. editor / Sokratis K. Katsikas ; Frederic Cuppens ; Nora Cuppens ; Costas Lambrinodakis ; Christos Kalloniatis ; John Mylopoulos ; Annie Anton ; Stefanos Gritzalis. Vol. 10683 Switzerland : Springer , 2018. pp. 250-261 (Lecture Notes in Computer Science).

@inproceedings{59e42dd6fe4643b49f959573f1b92338,

title = "An Anti-Pattern for Misuse Cases",

abstract = "Misuse case analysis is a method for the elicitation, documentation, and communication of security requirements. It builds upon the well-established use case analysis method and is one of the few existing techniques dedicated to security requirements engineering. We present an anti-pattern for applying misuse cases, dubbed “orphan misuses.” Orphan misuse cases by and large ignore the system at hand, thus providing little insight into its security. Common symptoms include implementation-dependent threats and overly general, vacuous mitigations. We illustrate orphan misuse cases through examples, explain their negative consequences in detail, and give guidelines for avoiding them.",

author = "Dashti, {Mohammad Torabi} and Sa{\v s}a Radomirovi{\'c}",

note = "no funding info; 1st International Workshop on SECurity and Privacy Requirements Engineering, SECPRE 2017 ; Conference date: 14-09-2017 Through 15-09-2017",

year = "2018",

doi = "10.1007/978-3-319-72817-9_16",

language = "English",

isbn = "9783319728162",

volume = "10683",

series = "Lecture Notes in Computer Science",

publisher = "Springer ",

pages = "250--261",

editor = "Katsikas, {Sokratis K.} and Frederic Cuppens and Nora Cuppens and Costas Lambrinodakis and Christos Kalloniatis and John Mylopoulos and Annie Anton and Stefanos Gritzalis",

booktitle = "Computer Security - ESORICS 2017 International Workshops, CyberICPS 2017 and SECPRE 2017, Revised Selected Papers",

url = "https://samosweb.aegean.gr/secpre2017/",

}

Dashti, MT & Radomirović, S 2018, An Anti-Pattern for Misuse Cases. in SK Katsikas, F Cuppens, N Cuppens, C Lambrinodakis, C Kalloniatis, J Mylopoulos, A Anton & S Gritzalis (eds), Computer Security - ESORICS 2017 International Workshops, CyberICPS 2017 and SECPRE 2017, Revised Selected Papers: ESORICS 2017 International Workshops, CyberICPS 2017 and SECPRE 2017, Oslo, Norway, September 14-15, 2017, Revised Selected Papers. vol. 10683, Lecture Notes in Computer Science, vol. 10683, Springer , Switzerland, pp. 250-261, 1st International Workshop on SECurity and Privacy Requirements Engineering, Oslo, Norway, 14/09/17. https://doi.org/10.1007/978-3-319-72817-9_16

An Anti-Pattern for Misuse Cases. / Dashti, Mohammad Torabi; Radomirović, Saša.
Computer Security - ESORICS 2017 International Workshops, CyberICPS 2017 and SECPRE 2017, Revised Selected Papers: ESORICS 2017 International Workshops, CyberICPS 2017 and SECPRE 2017, Oslo, Norway, September 14-15, 2017, Revised Selected Papers. ed. / Sokratis K. Katsikas; Frederic Cuppens; Nora Cuppens; Costas Lambrinodakis; Christos Kalloniatis; John Mylopoulos; Annie Anton; Stefanos Gritzalis. Vol. 10683 Switzerland: Springer , 2018. p. 250-261 (Lecture Notes in Computer Science; Vol. 10683).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

TY - GEN

T1 - An Anti-Pattern for Misuse Cases

AU - Dashti, Mohammad Torabi

AU - Radomirović, Saša

N1 - no funding info

PY - 2018

Y1 - 2018

N2 - Misuse case analysis is a method for the elicitation, documentation, and communication of security requirements. It builds upon the well-established use case analysis method and is one of the few existing techniques dedicated to security requirements engineering. We present an anti-pattern for applying misuse cases, dubbed “orphan misuses.” Orphan misuse cases by and large ignore the system at hand, thus providing little insight into its security. Common symptoms include implementation-dependent threats and overly general, vacuous mitigations. We illustrate orphan misuse cases through examples, explain their negative consequences in detail, and give guidelines for avoiding them.

AB - Misuse case analysis is a method for the elicitation, documentation, and communication of security requirements. It builds upon the well-established use case analysis method and is one of the few existing techniques dedicated to security requirements engineering. We present an anti-pattern for applying misuse cases, dubbed “orphan misuses.” Orphan misuse cases by and large ignore the system at hand, thus providing little insight into its security. Common symptoms include implementation-dependent threats and overly general, vacuous mitigations. We illustrate orphan misuse cases through examples, explain their negative consequences in detail, and give guidelines for avoiding them.

U2 - 10.1007/978-3-319-72817-9_16

DO - 10.1007/978-3-319-72817-9_16

M3 - Conference contribution

SN - 9783319728162

VL - 10683

T3 - Lecture Notes in Computer Science

SP - 250

EP - 261

BT - Computer Security - ESORICS 2017 International Workshops, CyberICPS 2017 and SECPRE 2017, Revised Selected Papers

A2 - Katsikas, Sokratis K.

A2 - Cuppens, Frederic

A2 - Cuppens, Nora

A2 - Lambrinodakis, Costas

A2 - Kalloniatis, Christos

A2 - Mylopoulos, John

A2 - Anton, Annie

A2 - Gritzalis, Stefanos

PB - Springer

CY - Switzerland

T2 - 1st International Workshop on SECurity and Privacy Requirements Engineering

Y2 - 14 September 2017 through 15 September 2017

ER -

Dashti MT, Radomirović S. An Anti-Pattern for Misuse Cases. In Katsikas SK, Cuppens F, Cuppens N, Lambrinodakis C, Kalloniatis C, Mylopoulos J, Anton A, Gritzalis S, editors, Computer Security - ESORICS 2017 International Workshops, CyberICPS 2017 and SECPRE 2017, Revised Selected Papers: ESORICS 2017 International Workshops, CyberICPS 2017 and SECPRE 2017, Oslo, Norway, September 14-15, 2017, Revised Selected Papers. Vol. 10683. Switzerland: Springer . 2018. p. 250-261. (Lecture Notes in Computer Science). Epub 2017 Dec 22. doi: 10.1007/978-3-319-72817-9_16

An Anti-Pattern for Misuse Cases

Abstract

Publication series

Conference

ASJC Scopus subject areas

Access to Document

Fingerprint

Cite this