Cyber Crime and Cyber Terrorism

51
 
Conducting user requirements elicitation
These factors can be related back to the cyber-security framework in order to high-
light key issues for user requirements investigations (
Table 5.1
).
Using the cyber-security framework to identify potential user requirements issues 
is an important part of specifying cyber-specifications. However, in order to capture 
meaningful data it is also important to consider the range of methods that are avail-
able. The use of formal methods in verifying the correctness of interactive systems 
should also include analysis of human behavior in interacting with the interface and 
must take into account all relationships between user’s actions, user’s goals, and the 
environment (
Cerone and Shaikh, 2008
).
CONDUCTING USER REQUIREMENTS ELICITATION
As previously discussed, whilst methods exist for identifying and gathering user 
needs in the security domain, they are relatively underdeveloped. It is only in the 
last decade that security aspects of interactive systems have been started to be sys-
tematically analyzed (
Cerone and Shaikh, 2008
); however, little research has been 
published on understanding the work of security personnel and systems which 
leads to the lack of case studies or guidance on how methods can be adopted or 
have been used in different security settings (
Hancock and Hart, 2002; Kraemer 
et al., 2009
). As a result it is necessary to revisit the fundamental issues of con-
ducting user requirements elicitation that can then be applied to security research.
Table 5.1 
Using the Cyber-Security Framework to Map Issues of Cyber-Trust
Factors
System Characteristics
Service provider factors
• Privacy, assurance and security features
• Robustness
• Fail safe characteristics (or redundancy)
User characteristics
• Propensity to trust/confidence
• Experience and proficiency in internet usage
• Expectation of what is being provided
• Levels of awareness about cyber-security threats
Security tools
• Social presence cues
• Customization and personalization capacity
• Constrained interfaces that allow free use (e.g., 
ability to convey details over a secure network)
• Dynamic nature should be seamless (and pervasive)
Security tasks
• User interface has high degree of usability
• Explicit security characteristics
• Information quality/quantity/timeliness
• Graphical characteristics
Operational environment
• Experience and familiarity with the online company
• Ease of use in different contexts of use
• Communicating different threat levels

---