CYBECO: Supporting cyber-insurance from a behavioural choice perspective

Security at the End of the Tunnel: The Anatomy of VPN Mental Models Among Experts and Non-Experts in a Corporate Context

With the worldwide COVID-19 pandemic in 2020 and 2021 necessitating working from home, corporate Virtual Private Networks (VPNs) have become an important item securing the continued operation of companies around the globe. However, due to their different use case, corporate VPNs and how users interact with them differ from public VPNs, which are...

Graphical vs. Tabular Notations for Risk Models: On the Role of Textual Labels

Security risk assessment methods in industry mostly use a tabular notation to represent the assessment results whilst academic works advocate graphical methods. Experiments with MSc students showed that the tabular notation is better than an iconic graphical notation for the comprehension of security risks. [Aim] We investigate whether the...

Estimating the Assessment Difficulty of CVSS Environmental Metrics: An Experiment

[Context] The CVSS framework provides several dimensions to score vulnerabilities. The environmental metrics allow security analysts to downgrade or upgrade vulnerability scores based on a company’s computing environments and security requirements. [Question] How difficult is for a human assessor to change the CVSS environmental score due to...

Assessing the effect of learning styles on risk model comprehensibility: A controlled experiment (short paper)

This paper presents the design of an experimental study and plan for the conduction of a live study with the participants of the REFSQ2019 conference. The study aims to evaluate the effect of learning styles on risk model comprehensibility throughout a controlled experiment. We combine the baseline experiment designed and conducted by one of...

An Adversarial Risk Analysis Framework for Cybersecurity

Risk analysis is an essential methodology for cybersecurity as it allows organizations to deal with cyber threats potentially affecting them, prioritize the defense of their assets, and decide what security controls should be implemented. Many risk analysis methods are present in cybersecurity models, compliance frameworks, and international...