Hanan Hibshi

Carnegie Mellon University

Author Statistics

Papers

Citation

H-Index

i-10 index

Research Trends

Author Order

Document Type

Co-Authors

Travis D. Breaux

Carnegie Mellon University

Lorrie Faith Cranor

Carnegie Mellon University

Yuvraj Agarwal

Carnegie Mellon University

Pardis Emami-Naeini

Duke University

Ashwini K. Rao

Columbia University Irving Medical Center

Daniel Smullen

Carnegie Mellon University

Maria Riaz

New England College of Optometry

Jean-Michel Lehker

The University of Texas at San Antonio

Laurie Williams

North Carolina State University

Christian Wagner

University of Nottingham

Cooperative Institutions

Carnegie Mellon University

Institute of Electrical and Electronics Engineers

North Carolina State University

Regional Municipality of Niagara

IEEE Computer Society

The University of Texas at San Antonio

Kyung Hee University

University of New Mexico

University of Washington

Pennsylvania State University

Author Statistics

Papers

Citation

H-Index

i-10 index

Research Field

Ask the Experts: What Should Be on an IoT Privacy and Security Label?

2022 IEEE Symposium on Security and Privacy (SP) (2020)

Pardis Emami-Naeini Yuvraj Agarwal Lorrie Faith Cranor Hanan Hibshi

Information about the privacy and security of Internet of Things (IoT) devices is not readily available to consumers who want to consider it before making purchase decisions. While legislators have proposed adding succinct, consumer accessible, labels, they do not provide guidance on the content of these labels. In this paper, we report on the results of a series of interviews and surveys with privacy and security experts, as well as consumers, where we explore and test the design space of the content to include on an IoT privacy and security label. We conduct an expert elicitation study by following a three-round Delphi process with 22 privacy and security experts to identify the factors that experts believed are important for consumers when comparing the privacy and security of IoT devices to inform their purchase decisions. Based on how critical experts believed each factor is in conveying risk to consumers, we distributed these factors across two layers-a primary layer to display on the product package itself or prominently on a website, and a secondary layer available online through a web link or a QR code. We report on the experts' rationale and arguments used to support their choice of factors. Moreover, to study how consumers would perceive the privacy and security information specified by experts, we conducted a series of semi-structured interviews with 15 participants, who had purchased at least one IoT device (smart home device or wearable). Based on the results of our expert elicitation and consumer studies, we propose a prototype privacy and security label to help consumers make more informed IoT-related purchase decisions.

Delphi Method

Privacy software

10.1109/sp40000.2020.00043

Cite

Citations (125)

Towards a framework to measure security expertise in requirements analysis

Hanan Hibshi Travis D. Breaux Maria Riaz Laurie Williams

Research shows that commonly accepted security requirements are not generally applied in practice. Instead of relying on requirements checklists, security experts rely on their expertise and background knowledge to identify security vulnerabilities. To understand the gap between available checklists and practice, we conducted a series of interviews to encode the decision-making process of security experts and novices during security requirements analysis. Participants were asked to analyze two types of artifacts: source code, and network diagrams for vulnerabilities and to apply a requirements checklist to mitigate some of those vulnerabilities. We framed our study using Situation Awareness-a cognitive theory from psychology-to elicit responses that we later analyzed using coding theory and grounded analysis. We report our preliminary results of analyzing two interviews that reveal possible decision-making patterns that could characterize how analysts perceive, comprehend and project future threats which leads them to decide upon requirements and their specifications, in addition, to how experts use assumptions to overcome ambiguity in specifications. Our goal is to build a model that researchers can use to evaluate their security requirements methods against how experts transition through different situation awareness levels in their decision-making process.

Security Awareness

10.1109/espre.2014.6890522

Cite

Citations (5)

Usability of Forensics Tools: A User Study

Hanan Hibshi Timothy Vidas Lorrie Faith Cranor

Digital forensics has become a critical part of almost every investigation, and users of digital forensics tools are becoming more diverse in their backgrounds and interests. As a result, usability is an important aspect of these tools. This paper examines the usability aspect of forensics tools through interviews and surveys designed to obtain feedback from professionals using these tools as part of their regularly assigned duties. The study results highlight a number of usability issues that need to be taken into consideration when designing and implementing digital forensics tools.

Computer forensics

10.1109/imf.2011.19

Cite

Citations (53)

Privacy Risk in Cybersecurity Data Sharing

Jaspreet Bhatia Travis D. Breaux Liora Friedberg Hanan Hibshi Daniel Smullen

As information systems become increasingly interdependent, there is an increased need to share cybersecurity data across government agencies and companies, and within and across industrial sectors. This sharing includes threat, vulnerability and incident reporting data, among other data. For cyberattacks that include sociotechnical vectors, such as phishing or watering hole attacks, this increased sharing could expose customer and employee personal data to increased privacy risk. In the US, privacy risk arises when the government voluntarily receives data from companies without meaningful consent from individuals, or without a lawful procedure that protects an individual's right to due process. In this paper, we describe a study to examine the trade-off between the need for potentially sensitive data, which we call incident data usage, and the perceived privacy risk of sharing that data with the government. The study is comprised of two parts: a data usage estimate built from a survey of 76 security professionals with mean eight years' experience; and a privacy risk estimate that measures privacy risk using an ordinal likelihood scale and nominal data types in factorial vignettes. The privacy risk estimate also factors in data purposes with different levels of societal benefit, including terrorism, imminent threat of death, economic harm, and loss of intellectual property. The results show which data types are high-usage, low-risk versus those that are low-usage, high-risk. We discuss the implications of these results and recommend future work to improve privacy when data must be shared despite the increased risk to privacy.

Data breach

Data Sharing

10.1145/2994539.2994541

Cite

Citations (20)

Hiding the Topology of an IEEE 802.15.4 Network with Limited Energy

S. Schwarz Dimitrios-Georgios Akestoridis Patrick Tague Hanan Hibshi

The Internet of Things is an ever-progressing area. As the number of Internet-connected devices grows, their security grows in complexity. The risk pertaining to the insecurity of these networks is also heightened by the fact that the user's physical environment can be affected by network attacks. The IEEE 802.15.4 wireless network standard provides MAC layer security but does not require MAC packet header encryption, which leaks useful information to an eavesdropper about the network topology. Prior work has demonstrated the use of obfuscation for wireless routing, but there is little existing work targeting energy-efficient topology obfuscation. Our work provides a method for obfuscating the network topology of an IEEE 802.15.4-based network by changing network association. Specifically, we propose the assignment of multiple aliases to each device during the network association phase to give the impression of many devices, wherein the role that a device presents can be further manipulated. We present two algorithms for coordinating aliases with the network authority, both providing multiple MAC addresses per device to degrade a potential attacker's ability to perform reconnaissance attacks. To evaluate our approach, we enhance the corresponding implementation in the popular ns-3 network simulator. We show that the achieved topology obfuscation comes in trade for increased overhead of the association process, both data overhead and latency, a trade-off that we study via simulation. Our ns-3 enhancements will be made publicly available as an open-source ns-3 branch, providing resources for the community and a way to validate and expand up on our work.

10.1109/cns53000.2021.9705054

Cite

Citations (1)

Systematic analysis of qualitative data in security

Hanan Hibshi

This tutorial will introduce participants to Grounded Theory, which is a qualitative framework to discover new theory from an empirical analysis of data. This form of analysis is particularly useful when analyzing text, audio or video artifacts that lack structure, but contain rich descriptions. We will frame Grounded Theory in the context of qualitative methods and case studies, which complement quantitative methods, such as controlled experiments and simulations. We will contrast the approaches developed by Glaser and Strauss, and introduce coding theory - the most prominent qualitative method for performing analysis to discover Grounded Theory. Topics include coding frames, first- and second-cycle coding, and saturation. We will use examples from security interview scripts to teach participants: developing a coding frame, coding a source document to discover relationships in the data, developing heuristics to resolve ambiguities between codes, and performing second-cycle coding to discover relationships within categories. Then, participants will learn how to discover theory from coded data. Participants will further learn about inter-rater reliability statistics, including Cohen's and Fleiss' Kappa, Krippendorf's Alpha, and Vanbelle's Index. Finally, we will review how to present Grounded Theory results in publications, including how to describe the methodology, report observations, and describe threats to validity.

Heuristics

Test theory

Coding theory

10.1145/2898375.2898387

Cite

Citations (0)

A grounded analysis of experts’ decision-making during security assessments

Journal of Cybersecurity (2016)

Hanan Hibshi Travis D. Breaux Maria Riaz Laurie Williams

Security analysis requires specialized knowledge to align threats and vulnerabilities in information technology. To identify mitigations, analysts need to understand how threats, vulnerabilities, and mitigations are composed together to yield security requirements. Despite abundant guidance in the form of checklists and controls about how to secure systems, evidence suggests that security experts do not apply these checklists. Instead, they rely on their prior knowledge and experience to identify security vulnerabilities. To better understand the different effects of checklists, design analysis, and expertise, we conducted a series of interviews to capture and encode the decision-making process of security experts and novices during three security analysis exercises. Participants were asked to analyze three kinds of artifacts: source code, data flow diagrams, and network diagrams, for vulnerabilities, and then to apply a requirements checklist to demonstrate their ability to mitigate vulnerabilities. We framed our study using Situation Awareness, which is a theory about human perception that was used to elicit interviewee responses. The responses were then analyzed using coding theory and grounded analysis. Our results include decision-making patterns that characterize how analysts perceive, comprehend, and project future threats against a system, and how these patterns relate to selecting security mitigations. Based on this analysis, we discovered new theory to measure how security experts and novices apply attack models and how structured and unstructured analysis enables increasing security requirements coverage. We highlight the role of expertise level and requirements composition in affecting security decision-making and we discuss how our method produced new hypotheses about security analysis and decision-making.

10.1093/cybsec/tyw010

Cite

Citations (10)

A Systemic Approach for Natural Language Scenario Elicitation of Security Requirements

IEEE Transactions on Dependable and Secure Computing (2021)

Hanan Hibshi Stephanie Tubbs Jones Travis D. Breaux

Security analysts rely on scenarios to assess vulnerabilities, project attacks, and decide on security requirements that mitigate the threat. However, eliciting natural language scenarios from stakeholders can be an ad-hoc process and subject to ambiguity and incompleteness. In this article, we examine systematic scenario elicitation by introducing a method based on user stories that uses a simplified process model of iterative scenario refinement. The process consists of three steps: 1) eliciting an interaction statement that describes a critical action performed by a user or system process; 2) eliciting one or more descriptive statements about a technology that enables the interaction; and 3) refinement of the technology into technical variants that correspond to design alternatives. We empirically evaluated our method by implementing our prototype in a user study that collects 30 security scenarios from participants. Based on our analysis, our proposed method is shown effective. Participants had a 100 percent task completion rate with 57 percent of participants achieving complete task-success, and the remaining 43 percent of participants achieving partial task-success. We also show the effect of security domain knowledge, and the benefit of using structure when collecting security requirements in natural language text. Finally, we present lessons learned and future research directions.

Statement (logic)

10.1109/tdsc.2021.3103109

Cite

Citations (6)

Improving security requirements adequacy

2021 IEEE Symposium Series on Computational Intelligence (SSCI) (2016)

Hanan Hibshi Travis D. Breaux Christian Wagner

Organizations rely on security experts to improve the security of their systems. These professionals use background knowledge and experience to align known threats and vulnerabilities before selecting mitigation options. The substantial depth of expertise in any one area (e.g., databases, networks, operating systems) precludes the possibility that an expert would have complete knowledge about all threats and vulnerabilities. To begin addressing this problem of fragmented knowledge, we investigate the challenge of developing a security requirements rule base that mimics multi-human expert reasoning to enable new decision-support systems. In this paper, we show how to collect relevant information from cyber security experts to enable the generation of: (1) interval type-2 fuzzy sets that capture intra- and inter-expert uncertainty around vulnerability levels; and (2) fuzzy logic rules driving the decision-making process within the requirements analysis. The proposed method relies on comparative ratings of security requirements in the context of concrete vignettes, providing a novel, interdisciplinary approach to knowledge generation for fuzzy logic systems. The paper presents an initial evaluation of the proposed approach through 52 scenarios with 13 experts to compare their assessments to those of the fuzzy logic decision support system. The results show that the system provides reliable assessments to the security analysts, in particular, generating more conservative assessments in 19% of the test scenarios compared to the experts' ratings.

Expert elicitation

Legal expert system

Vulnerability

10.1109/ssci.2016.7849906

Cite

Citations (5)

Towards a framework for pattern experimentation: Understanding empirical validity in requirements engineering patterns

Travis D. Breaux Hanan Hibshi Ashwini K. Rao Jean-Michel Lehker

Despite the abundance of information security guidelines, system developers have difficulties implementing technical solutions that are reasonably secure. Security patterns are one possible solution to help developers reuse security knowledge. The challenge is that it takes experts to develop security patterns. To address this challenge, we need a framework to identify and assess patterns and pattern application practices that are accessible to non-experts. In this paper, we narrowly define what we mean by patterns by focusing on requirements patterns and the considerations that may inform how we identify and validate patterns for knowledge reuse. We motivate this discussion using examples from the requirements pattern literature and theory in cognitive psychology.

Software design pattern

Behavioral pattern

10.1109/repa.2012.6359975

Cite

Citations (3)