一句话：研究安全专家、计算机科学家与管理者的安全决策模式差异及其对系统安全的影响。
本文关注系统安全如何由利益相关者的安全需求决策直接决定，而不同背景的决策者——安全专家、普通计算机科学家与管理者——在专业知识、经验与策略上存在差异。摘要提出一系列待研究问题：这些群体做出安全决策时有哪些典型决策模式？这些模式会带来什么后果，又如何影响系统安全？不同群体的策略与决策模式有何异同？在特定情境下，安全专业知识是否必然构成优势？作者强调，回答这些问题对于理解安全决策过程背后的“如何”与“为什么”至关重要。摘要仅给出研究动机与问题，未报告具体方法、评估或结论。
Motivation: The security of any system is a direct consequence of stakeholders' decisions regarding security requirements. Such decisions are taken with varying degrees of expertise, and little is currently understood about how various demographics - security experts, general computer scientists, managers - approach security decisions and the strategies that underpin those decisions. What are the typical decision patterns, the consequences of such patterns and their impact on the security of the system in question? Nor is there any substantial understanding of how the strategies and decision patterns of these different groups contrast. Is security expertise necessarily an advantage when making security decisions in a given context? Answers to these questions are key to understanding the "how" and "why" behind security decision processes.
DOI 原文 ·
@inproceedings{paperbot4412,
title = {The good, the bad and the ugly},
author = {Sylvain Frey and Awais Rashid and Pauline Anthonysamy and Maria Pinto-Albuquerque and Syed Asad Naqvi},
booktitle = {ICSE},
year = {2018},
doi = {10.1145/3180155.3182549}
}