Mitigating security threats using tactics and patterns: a controlled experiment

Gilberto Pedraza-García, René Noël, Santiago Matalonga, Hernán Astudillo, Eduardo B. Fernandez

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

27 Downloads (Pure)


Security Patterns and Architectural Tactics are two well-known techniques for designing secure software systems. There is little or no empirical evidence on their relative effectiveness for security threats mitigation. This study presents MUA (Misuse activities + Patterns), an extension of misuse activities that incorporates patterns, and reports on a controlled comparison of this method that incorporate these techniques for threat mitigation with regard to MAST (Methodology for Applying Security Tactics) which already incorporates tactics. A simple Tsunami Alert System design was analyzed and modified by 40 undergraduate students, and significant difference was found for security threats mitigation (averaging 3.0 for Patterns versus 1.9 for Tactics, in a 1-to-5 scale). This result is contrary to previous results with professional subjects, leading us to believe that novices benefit more of detailed advice than of high-level concepts.

Original languageEnglish
Title of host publicationProccedings of the 10th European Conference on Software Architecture Workshops - ECSAW '16
Place of PublicationNew York
PublisherACM Press
Number of pages7
ISBN (Print)9781450347815
Publication statusPublished - 28 Nov 2016
Externally publishedYes


  • Fondecyt


Dive into the research topics of 'Mitigating security threats using tactics and patterns: a controlled experiment'. Together they form a unique fingerprint.

Cite this