Security-Focused Prototyping: A Natural Precursor to Secure Development

Secure development is a proactive approach to cyber security. Rather than building a 1 technological solution and then securing it in retrospect, secure development strives to embed good 2 security practices throughout the development process and thereby reduces risk. Unfortunately, 3 evidence suggests secure development is complex, costly, and limited in practice. This article therefore 4 introduces security-focused prototyping as a natural precursor to secure development that embeds 5 security at the beginning of the development process, can be used to discover domain specific security 6 requirements, and can help organisations navigate the complexity of secure development such that 7 the resources and commitment it requires are better understood. Two case studies–one considering 8 the creation of a bespoke web platform and the other considering the application layer of an Internet 9 of Things system–verify the potential of the approach and its ability to discover domain specific 10 security requirements in particular. Future work could build on this work by conducting case studies 11 to further verify the potential of security-focused prototyping and even investigate its capacity to be 12 used as a tool capable of reducing a broader, socio-technical, kind of risk. 13