Mitigating security threats using tactics and patterns: a controlled experiment

Gilberto Pedraza-García, René Noël, Santiago Matalonga, Hernán Astudillo, Eduardo B. Fernandez

Research output: Chapter in Book/Report/Conference proceedingConference contribution

10 Downloads (Pure)

Abstract

Security Patterns and Architectural Tactics are two well-known techniques for designing secure software systems. There is little or no empirical evidence on their relative effectiveness for security threats mitigation. This study presents MUA (Misuse activities + Patterns), an extension of misuse activities that incorporates patterns, and reports on a controlled comparison of this method that incorporate these techniques for threat mitigation with regard to MAST (Methodology for Applying Security Tactics) which already incorporates tactics. A simple Tsunami Alert System design was analyzed and modified by 40 undergraduate students, and significant difference was found for security threats mitigation (averaging 3.0 for Patterns versus 1.9 for Tactics, in a 1-to-5 scale). This result is contrary to previous results with professional subjects, leading us to believe that novices benefit more of detailed advice than of high-level concepts.

Original languageEnglish
Title of host publicationProccedings of the 10th European Conference on Software Architecture Workshops - ECSAW '16
Place of PublicationNew York
PublisherACM Press
Pages1-7
Number of pages7
ISBN (Print)9781450347815
DOIs
Publication statusPublished - 28 Nov 2016
Externally publishedYes

Keywords

  • Fondecyt

Fingerprint Dive into the research topics of 'Mitigating security threats using tactics and patterns: a controlled experiment'. Together they form a unique fingerprint.

  • Research Output

    • 1 Conference contribution
    • 1 Paper

    Software development initiatives to identify and mitigate security threats: a systematic mapping

    Silva, P., Noël, R., Gallego, M., Matalonga, S. & Astudillo, H., 27 Apr 2016.

    Research output: Contribution to conferencePaper

    Open Access
    File

    Comparando patrones de seguridad y tácticas de seguridad para construir sistemas seguros: identificando amenazas de seguridad

    Translated title of the contribution: Comparison of security patterns and security tactics to build secure systems: Identifying security threats |Noël, R., Pedraza-García, G., Astudillo, H., Matalonga, S. & Encina, O., 2015, 18th Conferencia Iberoamericana en Software Engineering: (CIbSE 2015). Araujo, J., Condori-Fernandez, N., Goulao, M., Matalonga, S., Bencomo, N., Oliveira, T., de la Vara, J. L., Brito, I. S., Antonelli, L., Pimentel, E., Miranda, J. J., Kalinowski, M., Pastor, O., Olsina, L., Guizzardi, R., Espana, S. & Cuadros-Vargas, E. (eds.). Curran Associates, Inc., p. 236-247 12 p.

    Research output: Chapter in Book/Report/Conference proceedingConference contribution

    Open Access
    File

    Cite this

    Pedraza-García, G., Noël, R., Matalonga, S., Astudillo, H., & Fernandez, E. B. (2016). Mitigating security threats using tactics and patterns: a controlled experiment. In Proccedings of the 10th European Conference on Software Architecture Workshops - ECSAW '16 (pp. 1-7). [37] ACM Press. https://doi.org/10.1145/2993412.3007552