Security tactics selection poker (TaSPeR): a card game to select security tactics to satisfy security requirements

Building secure software architectures requires taking several design decisions to achieve security requirements; these decisions must be revised carefully before agreement given their impact on system vulnerability and mission-readiness. Architects customarily take these resolutions, drawing upon specialized knowledge like architectural tactics for security; developers also have key information on platforms and tools actual performance, but their input may not be systematically considered to this end. This article presents Security Tactics Selection Poker (TaSPeR), a card game-based technique and consensus-building technique (based on Planning Poker) that allows development team members to identify, argue for, and choose among architectural security tactics according to objectives and priorities. We conducted an experimental process involving twenty-one practitioners from a security software unit, to assess the technique effectiveness in several scenarios. Initial results show that TaSPeR (1) does support collaborative architectural decision-making, (2) encourages stakeholders participation, and (3) starts a group dynamics on how to act against threats. Thus, the use of gamification techniques for architectures evaluation seems to be a promising approach that deserves further exploration.