Are abuse cases and misuse cases for security the same? From what I have read in various sites, they appear to be same, but no where is it mentioned that they are same. Please clarify my doubt.
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
While I agree in the main with Tom77's answer. From a security perspective abuse/misuse lead to the same consequences.
However I would also suggest that misuse cases should be used as inputs to ongoing design and implementation reviews. Try to reduce the possibility of misuse. If the user can accidentally misuse the system then they will also have a lowered user satisfaction experience.
Yes, pretty much.
I think "abuse" suggests more malice than "misuse", but they both amount to people doing things with your software that they shouldn't be allowed to.
There is still ambiguity between the words. A quick Google search for "abuse case testing" brings up this which states:
I agree that abuse cases are a subset of misuse cases. I also agree that abuse cases contain more malice as Tom77 suggested.
But if a line has to be drawn and a definition given:
Abuse cases are destructive, and only an extremely small percentage of users will have that mentality, so a lot of times I've found that managers decide to fix them last, if at all.
Misuse cases, on the other hand, actually go about and help improve the quality of the system, and I've found that issues found during this process are fixed relatively quickly, or marked as change requests / enhancements to be fixed in the near future (which goes in addition to what Steve mentioned earlier).