.png){kind=icon}
Return
Towards an integrated security decision-making framework
.png){kind=icon}
OA
AI
DOI：10.1016/j.cose.2026.105172.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Security decision-making in socio-technical systems can often be limited by fragmented analytical approaches that may struggle to address the complexities of modern threats. This article proposes an integrated multidisciplinary framework that synthesises five key pillars: Goal-Oriented Requirements Engineering (GORE), Risk Assessment (RA), Crime Scripting (CSA), Quantitative Decision Analysis (QDA), and Attack-Graph Modelling (AGM). By incorporating attack graphs as a fifth layer, the framework seeks to provide a dual-view of the adversary, bridging the gap between human procedural behaviour (the script) and technical exploit dependencies (the graph). This integrated approach is designed to assist decision-makers in systematically identifying stakeholder goals, characterising multi-path attack trajectories, and evaluating resolution actions using explicit uncertainty ranges. The framework generates a Unified Conceptual Model—a visual, auditable artefact intended to reveal underlying trade-offs between security, usability, and profitability. Illustrated through a demonstrative case study, this research offers practitioners a structured decision-support model with potential applicability to finance, critical infrastructure, and cloud environments.
Keywords:
Security decision-making
Attack graphs
Crime scripting
Risk assessment
Requirements engineering
Identity theft
Uncertainty
Journal
C
IF:
5.4
Papers:
299
Citations:
0
Organization
No organization information available
Cited Papers
No cited papers available