I know that misuse cases are use cases which help identify security requirements as they highlight the user's goal in misusing the system, but what exactly is abuse cases and what is the difference or these very similar to each other?


The nuance is subtle and not well-defined, but if you really want to make a distinction between misuse and abuse, then I'd say that abuse is "misuse with malicious intent".

E.g. running while carrying a powered chainsaw is misuse; doing so on purpose in a crowded mall is abuse.

  • Academic definitions actually reverse the definitions compared to what you stated. Misuse is malicious. Abuse does not define intent. – schroeder Oct 19 '18 at 10:10

Misuse Case:

It describes the process of executing a malicious act against a system, while use case can be used to describe any action taken by the system.

Abuse Case:

A complete abuse case defines an interaction between an actor and the system that results in harm to a resource associated with one of the actors, one of the stakeholders, or the system itself.

Contrary to what most people would naturally conclude, "Misuse Cases" require malicious intent, "Abuse Cases" do not. Misuse Case is the antithesis of the Use Case where users are not doing what they should according to established procedure. Actors are "mis-using" the system. "Abuse Case" seems to draw from the technical etymology of the term "ab-use", meaning "outside of the use".

"Misuse Case" is an intentional violation of the system by a "Mis-Actor". Misuse Cases analyse user/actor threats to the system.

"Abuse Case" does not include intent in its analysis. It is focused on the set of actions that can cause harm. Abuse Cases analyse system vulnerabilities.

But these terms are new and practitioners are defining them as we go.

Further reading on the differences as of 2005


Misuse may be accidental, and implies that you are using the system in a way not designed.

  • e.g., run rm -rf on your filesystem

Abuse is usually premeditated and purposeful; you can abuse a system without misusing it by doing legitimate activities in an unauthorized manner.

  • e.g., DDoS attack using legitimate requests to load a page

You may be interested to read the legal text of Computer Fraud and Abuse Act (CFAA) [USA].


I found a formal definition of "computer abuse" from NIST in their Glossary of Key Information Security Terms :

Computer Abuse – Intentional or reckless misuse, alteration, disruption, or destruction of information processing resources.

However, whereas the US has an "abuse" act, the UK has a "misuse" act (Computer Misuse Act 1990) (another ref), as does Signapore (Computer Misuse and Cybersecurity Act (CHAPTER 50A)) which sounds closer to the definition of abuse.

  • Misuse Case and Abuse Case have formal definitions. The NIST definition of "computer abuse" and "computer misuse" laws are not applicable. – schroeder Oct 19 '18 at 11:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.