Security-Focused Prototyping: A Natural Precursor to Secure Development

Abstract

Secure development is often thought of as a proactive approach to cyber security. Rather than building a technological solution and then securing it in retrospect, secure development strives to embed good security practices throughout the development process and reduce risk. Unfortunately, evidence suggests secure development is complex, costly, and limited in practice. This article therefore introduces security-focused prototyping as a natural precursor to secure development. Security-focused prototyping embeds security at the beginning of the development process, can be used to discover domain-specific security requirements through active learning, and can help communicate the complexity of secure development to organizations such that the resources and commitment it requires are better understood. A case study considering the application layer of an Internet of Things system is presented and shows that security-focused prototyping has the potential to facilitate further secure development through the achievement of well-established prototyping objectives, such as communication, active learning, and reduced time/costs. Future work could build on this work by conducting additional case studies to further explore the potential of security-focused prototyping and investigating the importance of fidelity with regards to security-focused prototypes.