Risk Assessment Using Security Requirements Adequacy .pdf

POSTER: Risk Assessment Using Security Requirements Adequacy

PRESENTER: Hanan Hibshi, Carnegie Mellon University

ABSTRACT:
Organizations rely on security experts to improve the security of their systems. These professionals use background knowledge and experience to align known threats and vulnerabilities before selecting mitigation options. The substantial depth of expertise in any one area (e.g., databases, networks, operating systems) precludes the possibility that an expert would have complete knowledge about all threats and vulnerabilities. To begin addressing this problem of fragmented knowledge, we investigate the challenge of developing a security requirements rule base that mimics multi-human expert reasoning to enable new decision-support systems. In this work, we show how to collect relevant information from cyber security experts to enable the generation of: (1) interval type-2 fuzzy sets that capture intra- and inter-expert uncertainty around vulnerability levels; and (2) fuzzy logic rules driving the decision-making process within the requirements analysis. The proposed method relies on comparative ratings of security requirements in the context of concrete vignettes, providing a novel, interdisciplinary approach to knowledge generation for fuzzy logic systems.

CO-PRESENTER(S):

KEYWORDS: 
Pittsburgh

PRESENTER BIO:
Hanan Hibshi is a Ph.D. candidate in the Societal Computing program at Carnegie Mellon University. Hanan's research area includes: usable security, security requirements and expert's decision-making. Hanan's research involves using grounded theory and mixed-methods user experiments to extract rules for use in intelligent systems. Hanan received her MS in Information Security Technology and Management from the Information Networking Institute at Carnegie Mellon University, and the BS in Computer Science from King Abdul-Aziz University in Jeddah, Saudi Arabia.