Post

Assessments of threats can be seen from different perspectives. Developers may come across privacy impact assessments (PIAs), where threats to users' data and the impact on those users are paramount. PIAs may additionally examine harms to organisations, third parties and wider society. (1/6) #games

In recent years, Colin Watson, who created OWASP Cornucopia in 2012, undertook a PhD at Newcastle University, UK. This examined how the digital implementation of e-government services impacts citizens. (2/6) #threatmodeling #appsec #security #welfare #benefits #disbenefits #cornucopia #games

The research's scope was digitisation of social protection cash payments (in the UK called “welfare benefits”) and those working-age citizens who apply for, and possibly receive, the support payments (in the UK known as “benefit claimants”). (3/6) #threatmodeling #security #welfare #benefits

Following completion of the PhD, Colin Watson gathered together harms identified that can arise through the choices made during the software development for these e-government services. These are far broader and deeper than the few accessibility matters (constrained to concerns about the UI). (4/6)

These harms have now also been converted into a Cornucopia deck of cards, to help teams identify negative impacts on the service users, and thus to provide requirements which avoid or minimise such harms. The deck is called “Digital Benefits and Disbenefits Cornucopia” and uses the same game method.

This game is now available at copi.owasp.org! Read more at: dev.to/owasp/dbd-co... (6/6) #threatmodeling #appsec #security #welfare #benefits #disbenefits #cornucopia #games