Security Requirements Elicitation: An Agenda for Acquisition of Human Factors

Systems And Security Requirements Elicitation: Human Factors

More often than not, it is becoming increasingly evident that the weakest links in an information-security chain are the people, because human nature and social interactions are much easier to manipulate than targeting the complex technological protections of information systems. Concerns and threats regarding human and social factors in organizational security are increasing at an exponential rate and shifting the information security paradigm. The growing number of instances of breaches in information security in the last few years has created a compelling case for efforts towards secure electronic systems. Security has been the subject of intensive research in the areas of cryptography, hardware, and networking. However, despite these efforts, designers often understand security as only the hardware or software implementation of specific cryptographic algorithms and security protocols. However, human factors are as important. Their non-functional nature imposes complex constraints on the emergent behavior of software-intensive systems, making them hard to understand, predict, and control. Figure 1 shows information systems requirements that have been amply researched, including human elements of it, though the concentric circle representing the information assurance requirements with the overlap with circle representing human factors is understudied.

Figure 1.

Research coverage and areas