Welcome to the InfoSci Platform
Eliciting Policy Requirements for Critical National Infrastructure Using the IRIS Framework

Eliciting Policy Requirements for Critical National Infrastructure Using the IRIS Framework

Shamal Faily, Ivan Fléchais
Copyright: © 2013 |Pages: 20
ISBN13: 9781466624825|ISBN10: 1466624825|EISBN13: 9781466624832
DOI: 10.4018/978-1-4666-2482-5.ch003
Cite Chapter Cite Chapter

MLA

Faily, Shamal, and Ivan Fléchais. "Eliciting Policy Requirements for Critical National Infrastructure Using the IRIS Framework." Developing and Evaluating Security-Aware Software Systems, edited by Khaled M. Khan, IGI Global, 2013, pp. 36-55. https://doi.org/10.4018/978-1-4666-2482-5.ch003

APA

Faily, S. & Fléchais, I. (2013). Eliciting Policy Requirements for Critical National Infrastructure Using the IRIS Framework. In K. Khan (Ed.), Developing and Evaluating Security-Aware Software Systems (pp. 36-55). IGI Global. https://doi.org/10.4018/978-1-4666-2482-5.ch003

Chicago

Faily, Shamal, and Ivan Fléchais. "Eliciting Policy Requirements for Critical National Infrastructure Using the IRIS Framework." In Developing and Evaluating Security-Aware Software Systems, edited by Khaled M. Khan, 36-55. Hershey, PA: IGI Global, 2013. https://doi.org/10.4018/978-1-4666-2482-5.ch003

Export Reference

Mendeley
Favorite

Abstract

Despite existing work on dealing with security and usability concerns during the early stages of design, there has been little work on synthesising the contributions of these fields into processes for specifying and designing systems. Without a better understanding of how to deal with both concerns at an early stage, the design process risks disenfranchising stakeholders, and resulting systems may not be situated in their contexts of use. This paper presents the IRIS process framework, which guides technique selection when specifying usable and secure systems. The authors illustrate the framework by describing a case study where the process framework was used to derive missing requirements for an information security policy for a UK water company following reports of the Stuxnet worm. The authors conclude with three lessons informing future efforts to integrate Security, Usability, and Requirements Engineering techniques for secure system design.

Request Access

You do not own this content. Please login to recommend this title to your institution's librarian or purchase it from the IGI Global bookstore.