DISI Security Research Group Wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Risk Models Comprehension: An Empirical Comparison of Tabular vs. Graphical Representations with Professionals ======

This page provides additional resources that enable replication of our experiment with professionals. See the [[validation_of_risk_and_security_requirements_methodologies|main page]] for our work on empirical validation of security risk assessment methods and other experiments.

==== Goal ====
The goal of our study is to investigate the effect of task complexity and notation on the level of comprehension of information about security risks w.r.t. extracting information about security risks from the models

===== Context of the Experiment =====

==== Subjects ====
In January-February 2016 we conducted online experiment with 61 professionals with an average 9 years of working experience. The participants were recruited through the mailing lists.

==== Application Scenarios ====
As application scenarios we had Online Banking scenario developed by our industrial partner, a large
Italian corporation offering integrated services in finance, logistics, and mobile communication with a turnaround of around 24 billion Euro. The scenario describes the online banking services provided by the company through a home banking portal, a mobile application and prepaid cards.

==== Supplement Materials ====
Here are the materials that our participants received depending on the assigned treatment:

  * Tutorial on the tabular risk modeling notations and application scenario {{:research_activities:experiments:2016-compr-pro:tutorial-tabular.pdf|PDF}}.
  * Tutorial on the UML risk modeling notations and application scenario {{:research_activities:experiments:2016-compr-pro:tutorial-uml.pdf|PDF}}.
  * Tutorial on the CORAS risk modeling notations and application scenario {{:research_activities:experiments:2016-compr-pro:tutorial-coras.pdf|PDF}}.
  * Online Banking tabular risk model {{:research_activities:experiments:2016-compr-pro:model-tabular-ob-2015.xlsx|XLSX}}.
  * Online Banking UML risk model {{:research_activities:experiments:2016-compr-pro:model-uml-ob-2015.pdf|PDF}}.
  * Online Banking CORAS risk model {{:research_activities:experiments:2016-compr-pro:model-coras-ob-2015.pdf|PDF}}.