Abstract

s.brostoff @ cs. ucl.ac.uk This paper firstly argues that the design of security applications needs to consider more than technical elements. Since almost all security systems involve human users as well as technology, security should be considered, and designed as, a socio-technical work system. Secondly, we argue that safety-critical systems design has similar goals and issues to security design, and should thus provide a good starting point. Thirdly, we identify Reason's (1990) Generic Error Modeling

Citations

382	Human Error - Reason - 1999
343	A comparison of commercial and military computer security policies - Clark, Wilson - 1987
166	Users are not the enemy - Adams, Sasse - 1999
99	Security Engineering - Anderson - 2001
16	Fortresses built upon sand - Baker - 1996
12	Pass-algorithms: a user validation scheme based on knowledge of secret algorithms - Haskett - 1984
8	New security paradigms: what other concepts do we need as well - Dobson - 1993
7	Mitnick to lawmakers: People, phones and weakest links - Poulsen - 2009
3	Understanding the use of passwords - Menkus - 1988
2	private communication - Hudson
2	Transforming the ‘weakest link’: a human-computer interaction approach to usable and effective security - Cambridge, A, et al. - 2001
2	Pass sentence - a new approach to computer code - Spector - 1994
1	Prospect on security paradigms. Proceedings of the 1993 workshop on new security paradigms. August 225 - Washington, LaPadula, et al.