![](bgc.png)
These attacks and the corresponding attacker’s traces
are in the hand of security practitioners. Therefore,
we need to solve very practical issues in order to make
our toolset usable and used by them before starting
to improve its retrospective and prospective predic-
tion: we have to find a way to access and then to ex-
tract from raw logs the information useful to correlate
socio-technical attacks with user actions and attacker
activities.
We believe that the shortcomings we identified
can be fixed, and that by improving S·CREAM’s ta-
bles, by maintaining our toolset’s knowledge of se-
curity and human-related factors, and by fostering its
use and the sharing of experiences, our toolkit can be
a useful addition to a security practitioner’s toolbox,
but we need to fully implement such ameliorations.
REFERENCES
Adams, A. and Sasse, A. (1999). Users Are Not the Enemy.
Comm. ACM, 42:40–46.
Anderson, R. J. (2008). Security Engineering: A Guide to
Building Dependable Distributed Systems. Wiley.
Beautement, A., Becker, I., Parkin, S., Krol, K., and
Sasse, M. A. (2016). Productive Security: A Scal-
able Methodology for Analysing Employee Security
Behaviours. In Proceedings of the Symposium on Us-
able Privacy and Security (SOUPS) 2016. USENIX
Association: Denver, CO, USA. in press.
Bianco, D. (2014). The pyramid of pain. Avail-
able at http://detect-respond.blogspot.lu/2013/03/the-
pyramid-of-pain.html.
Boring, R. L. (2012). Fifty Years of THERP and Human
Reliability Analysis. Proceedings of PSAM11.
Bostock, M., Ogievetsky, V., and Heer, J. (2011).
D3: Data-driven documents. Available at
http://vis.stanford.edu/papers/d3. IEEE Trans.
Visualization & Comp. Graphics (Proc. InfoVis).
Boyd, J. (1995). The essence of winning and losing.
Brumfield, J. (2015). 2015 Data Breach Investigations Re-
port. Technical report, Verizon.
Caralli, R., Stevens, J., Young, L., and Wilson, W. (2007).
Introducing octave allegro: Improving the information
security risk assessment process. Technical Report
CMU/SEI-2007-TR-012, Software Engineering Insti-
tute, Carnegie Mellon University, Pittsburgh, PA.
Cotroneo, D., Paudice, A., and Pecchia, A. (2016). Au-
tomated root cause identification of security alerts:
Evaluation in a SaaS Cloud. Future Generation Com-
puter Systems, 56:375 – 387.
ENISA (2016). Annual Incident Reports 2015. Technical
Report October, ENISA - European Union Agency for
Network and Information Security.
Ferreira, A., Huynen, J., Koenig, V., and Lenzini, G. (2015).
In Cyber-Space No One Can Hear You S·CREAM -
A Root Cause Analysis for Socio-Technical Security.
In STM, volume 9331 of Lecture Notes in Computer
Science, pages 255–264. Springer.
Google (2016). AngularJS. Available at
https://angularjs.org/.
Huynen, J. (2016). S·CREAM Assistant, a tool
to support S·CREAM analyses. Available at
https://github.com/gallypette/SCREAM-Assistant.
International Organization for Standardization, Geneva, S.
(2005). ISO/IEC 27001:2005 - Information technol-
ogy – Security techniques – Information security man-
agement systems – Requirements. Technical report.
Ishikawa, K. and Ishikawa, K. (1988). What is Total Quality
Control? the Japanese Way. Prentice Hall.
Js-data Development Team (2016). Js-data. Available at
http://www.js-data.io/.
Kasikci, B., Schubert, B., Pereira, C., Pokam, G., and Can-
dea, G. (2015). Failure sketching: A technique for
automated root cause diagnosis of in-production fail-
ures. In Proceedings of the 25th Symposium on Oper-
ating Systems Principles, SOSP ’15, pages 344–360,
New York, NY, USA. ACM.
Kirlappos, I., Parkin, S., and Sasse, M. A. (2014). Learn-
ing from “shadow security:” why understanding non-
compliant behaviors provides the basis for effective
security. In Proceedings 2014 Workshop on Usable
Security. Internet Society.
MITRE (2014). CAPEC - Common Attack Pat-
tern Enumeration and Classification. Available at
https://capec.mitre.org/.
Noureddine, M., Keefe, K., Sanders, W. H., and Bashir,
M. (2015). Quantitative security metrics with human
in the loop. In Proceedings of the 2015 Symposium
and Bootcamp on the Science of Security, HotSoS ’15,
pages 21:1–21:2, New York, NY, USA. ACM.
Reason, J. (1990). Human Error. Cambridge University
Press.
Schneier, B. (2014). The future of incident response.
Schoenfisch, J., von St
¨
ulpnagel, J., Ortmann, J., Meilicke,
C., and Stuckenschmidt, H. (2015). Using abduc-
tion in markov logic networks for root cause analysis.
CoRR, abs/1511.05719.
Strauch, B. (2004). Investigating Human Error: Incidents,
Accidents, and Complex Systems. Ashgate Pub Ltd.
Swain, A., of Nuclear Regulatory Research, U. N. R. C. O.,
and Guttmann, H. (1980). Handbook of Human Relia-
bility Analysis With Emphasis on Nuclear Power Plant
Applications - Draft Report For Interim Use and Com-
ment. NUREG/CR. U.S. Nuclear Regulatory Com-
mission.
yubico AB (2012). Yubikey security evaluation: Dis-
cussion of security properties and best prac-
tices. Available at https://www.yubico.com/wp-
content/uploads/2012/10/Security-Evaluation-
v2.0.1.pdf.
yubico AB (2015). The yubikey manual: Usage,
configuration and introduction of basic con-
cepts. Available at https://www.yubico.com/wp-
content/uploads/2015/03/YubiKeyManual v3.4.pdf.
ICISSP 2017 - 3rd International Conference on Information Systems Security and Privacy
224