A Contingency Framework to Assure the User-Centered Quality and to Support the Design of Anti-Phishing Software

The spread of phishing intensifies the need for well-defined security requirements in the design of an information system. Phishing goes on increasing, especially in the e-services domain, even though a variety of prevention methods have been developed and used against it. Phishing attacks compromise the software quality features of a system. In our study, we focus on how to prevent phishing attacks with the misuse case method from a system design perspective. After presenting the phishing attack techniques and the related threats, we introduce and evaluate three kinds of the existing phishing prevention methods. As an evaluation result, we express our support and give a brief introduction to the misuse case method; we subsequently construct an example scenario to illustrate the method’s application in the phishing prevention domain. After the discussion on phishing prevention based on the misuse cases identification , we conclude that it is possible to cater for phishing attacks at the system design level, by considering design quality features that ensure system's security. 1.0 Introduction Software quality [1, 2, 3] is not a set of essentially wanted and desirable features that can be added to a system after its realisation; software quality features [1, 2, 4, 5, 3], and especially those that deal with functionality, are planned and designed from the very initial phases of the software development lifecycle [1, 2, 4, 5]. Dealing with system functionality, ISO 9126 defines functionality as a set of attributes that bear on the existence of functions and their specified properties [1, 2, 4, 5, 3]. The functions are those that satisfy stated or implied needs; therefore, they must be and prove to be suitable, accurate, secure and with certain interoperability features [see e.g. 3]. Evidently, many existing information systems do not bear these characteristics no matter what and how software development methods, tools and quality models are used [see e.g. 1 and 2].