Security and usability represent essential aspects to consider in the process of the development of technological solutions. However, there is evidence of a great separation of these aspects that requires special attention. Before generating research on usable security issues, this article presents a systematic review whose purpose was to identify related works that propose usability activities in the planning phase of the life cycle of secure software development.
Requirements Engineering corresponds to the branch of Software Engineering that
deals with documenting information systems'needs and establishing their
functionalities and limitations [
The next section presents the related issue. Next, section 2 presents the conceptual basis on which this review is supported. Section 3 presents information on the process that was carried out to carry out the systematic review. Section 4 Information on the results obtained, and finally, in Section V, conclusions of the work carried out are presented.
Copyright c 2020 for this paper by its authors. Use permitted under Creative Commons
Every day, modern information systems (IS) grow in size and become more
complex, making their monitoring and security considerably more difficult.
Organizations that implement these information systems to manage day-to-day
operations are spending billions of dollars on security technologies such as firewalls,
encryption software, and more to ensure their data security. Most of the time,
organizations and information stakeholders forget to address issues related to the
security chain's weakest link: human or usability concerns [
Requirements are a nexus between HCI and information security, however, it is
often confused about the security requirements, how they should be expressed, and
how they should best be obtained and analyzed. Techniques and frameworks are
lacking to address usability, requirements, and security concerns jointly. Existing tool
support for usability engineering is weak, and existing tool support for security
engineering suffers from scalability when integrated with complementary approaches
[
Over the years, different security mechanisms have been incorporated to achieve
these goals, such as authentication and authorization. However, the rate of attacks on
computer systems increases, and the situation can be critical, especially for large
systems. Because of this, many researchers pay attention to the field of software
security to produce a high-security system [
There are significant financial and reputational losses related to security issues that
could have been addressed during requirements specification. While various
approaches have been proposed for specifying security requirements, there is a
definite lack of support during testing [
To investigate and contribute to the integration of usability activities in the
requirements analysis phase in a secure development methodology, it begins with the
search for literature through a systematic review, supported by the methodology
proposed by Kitchenham and Charters [
Definitions that are considered necessary to recognize before presenting the results of
the systematic review are presented below:
The International Standard Organization (ISO) defines usability “extent to which a
system, product or service can be used by specified users to achieve specified goals
with effectiveness, efficiency and satisfaction in a specified context of use [
“Security software is usable if people who are expected to use it: are reliably made
aware of the security tasks they need to perform; are able to figure out how to
successfully perform those tasks; don’t make dangerous errors; are sufficiently
comfortable with the interface to continue using it” [
Software engineering is an engineering discipline concerned with all aspects of
software production, from the early stages of system specification to the system's
maintenance after it is put into operation [
The requirements specify what the system should do (its functions) and its essential
and desirable properties. The main objective of capturing the requirements is to
understand what customers and users expect the system to do. A requirement
expresses the purpose of the system without considering how it will be implemented.
In other words, requirements identify the what of the system, while the design
establishes the how of the system [
The literature search was supported by the guidelines for conducting systematic
literature reviews in software engineering [
The key words used in the searches for related works were selected; these words were: usability, methodology, development, and secure software, to obtain the most significant documentation search, synonyms, and terms similar to the critical terms. In this regard, Table 1 shows the list of words in the English and Spanish search languages.
The databases selected to carry out the systematic review are presented in Table 2. Articles, conferences, books, book chapters that are published, among others, which are considered to be timely sources of information for searching for information.
Tabla 2. Selected Databases
Database
IEEE Xplore ACM Digital Library
Web of Science
Scopus Springer
Link https://ieeexplore.ieee.org/
https://dl.acm.org/ https://webofknowledge.com https://www.scopus.com/ https://www.springer.com
The inclusion and exclusion criteria considered in the systematic review are presented below:
1. Documents related to the initial phase of the software development process. 2. Documents that are related to usability activities with the initial phase of the secure software development process. 3. The searches will be in languages: Spanish and English.
4. Only articles published after 2009 will be considered.
Exclusion criteria 1. Articles that do not have full access are not considered. 2. Terms and synonyms other than those defined in the systematic review process are not considered. 3. Documents other than: Articles (Conferences and Journals) and Magazines (Magazines) are not considered. 4. Searches other than metadata are not considered: Title, Abstract and Author's Keywords.
Based on the previously established terms and the purpose of the systematic review, the following search strings were established:
Tabla 3. Query search in Spanish and English.
Language Spanish English
Query search ((Usab*) AND (Metodo* OR Proceso) AND (Desarrollo OR Programación)
AND ("Software Seguro")) AND (AÑO >= 2009) ((Usab*) AND (Method* OR Model OR Framework) AND (Development) AND (("Software Secur*") OR ("Application Secur*"))) AND (AÑO >= 2009)
The search procedure is carried out by accessing the five defined databases (IEE Xplore, ACM Digital Library, and Web of Science, Scopus, and Springer), defining an advanced search string with established keywords. Once the results were obtained, they were organized in a spreadsheet, assigning a number to each article. From the search, 44 articles were obtained, distributed in the different databases (see Fig. 1). The selection of papers was supported by two search filters that are detailed below:
A first review of the documents is carried out, reviewing the documents' abstracts and considering the first two inclusion criteria.
1. Documents related to the initial phase of the software development process. 2. Documents related to usability activities in the initial phase of the software development process.
Table 4 presents information on the number of articles included and articles excluded from the first filter.
Introductions and conclusions of the 15 articles resulting from the first filter were reviewed, and the first two inclusion criteria were considered. Table 5 shows the list of articles included and articles excluded from the second filter.
The second filter results in 6 articles, which are reviewed in their entirety. From this review, 3 articles have been selected that answer the research question. The relationship between the number of articles and the year of publication is presented in Fig 2.
It is important to note that no articles were found in Spanish; all articles were accessed, the articles were written entirely in English, and no repeated articles were found.
The most critical points of the 3 articles that are part of the research process, which will allow us to answer the systematic review question, are described below.
The article "Closing the Feedback Loop Between UX Design, Software
Development, Security Engineering, and Operations" [
The paper “Developer-centered security and the symmetry of ignorance” [
The paper “Secure and Usable Requirements Engineering” [
This systematic review is a basis for developing other research on issues related to usability activities in the requirements gathering stages, as part of a secure development methodology.