Cyber Crime and Cyber Terrorism

CHAPTER
43
5
Cyber-specifications: 
capturing user 
requirements for cyber-
security investigations
Alex W. Stedmon, Dale Richards, Siraj A. Shaikh, John Huddlestone,
Ruairidh Davison
INTRODUCTION
In many security domains, the “human in the system” is often a critical line of de-
fense in identifying, preventing, and responding to any threats (
Saikayasit et al., in 
print
). Traditionally, these domains have been focused in the real world, ranging 
from mainstream public safety within crowded spaces and border controls, through 
to identifying suspicious behaviors, hostile reconnaissance and implementing 
counter-terrorism initiatives. In these instances, security is usually the specific re-
sponsibility of front-line personnel with defined roles and responsibilities operating 
to organizational protocols (
Saikayasit et al., 2012; Stedmon et al., 2013
).
From a systems perspective, the process of security depends upon the performance 
of those humans (e.g., users and stakeholders) in the wider security system. Personnel 
are often working in complex and challenging work environments where the nature of 
their job is that specific security breaches may be very rare and so they are tasked with 
recognizing small state changes within a massive workflow, but where security inci-
dents could have rapid and catastrophic consequences (e.g., airline baggage handlers 
not identifying an improvised explosive device in a passengers luggage).
Furthermore, with the increasing presence of technology in security provision 
there is a reliance on utilizing complex distributed systems that assist the user, and 
in some instances are instrumental in facilitating decisions that are made by the user. 
However, one of the significant benefits of deploying dedicated security personnel 
is that they often provide operational flexibility and local/tacit knowledge of their 
working environment that automated systems simply do not possess (
Hancock and 
Hart, 2002; Stedmon et al., 2013
).
Through a unique understanding of their work contexts (and the ability to notice 
subtle patterns of behavior and underlying social norms in those environments) se-
curity personnel represent a key asset in identifying unusual behaviors or suspicious 
incidents that may pose a risk to public safety (
Cooke and Winner, 2008
). However, 

---