Case Studies in Teaching Information Security: Bridging the Gap between Theory and Practice

P. 157–168.

Avdoshin S. M., Savelieva A.

Today the demand is growing for information security experts capable of analyzing problems and making decisions in business situations that involve risk or uncertainty. These skills can be acquired through systematic studying of various information security incidents. In this paper we propose a framework of methods, tools and taxonomies for analysis of case studies in information security field. Our framework allows to study every situation in a formal rather than ad-hoc way, and apply a wide range of threat modeling, risk analysis and project management techniques under lifelike conditions. We illustrate it by providing a case study based on a real conflict situation between a free email service provider and a commercial bank.

Keywords: образование, риск, информационная безопасность, education, risk, information security, case study, кейс-стади, security incident, event chain, Parkerian Hexad, threat, STRIDE, information asset, attack lifecycle, инцидент информационной безопасности, цепочка событий, гексада Паркера, угроза, информационный актив, жизненный цикл атаки

In book

Satellite Workshops & Doctoral Consortium

Nizhny Novgorod: Higher School of Economics in Nizhny Novgorod, 2012.