A mis-use Case, which is derived from use case, is a business process modeling term used to describe the steps and scenarios which a user performs in order to accomplish a malicious act against a system or business process.  They are still use cases in the sense that they define the steps that a user performs to achieve a goal, even if the goal isn’t a positive one or a desired one from the perspective of the business process or system designers.

Because a misuse case is a type of use case, all of the information that you might already know about use cases apply.

Creating misuse cases places an early emphasis on security features that business processes and systems should consider.  Often, the creation of misuse cases will lead to the creation of new use cases as countermeasures to the malicious act.

Consider the case where an analyst is designing the registration experience for a mobile application.  For convenience, the analyst may not want to require the new user to have to check their email and click a verification link to prove the email belongs to them before accessing the application.  However, there is an important misuse case to document and consider and that is the case where another user attempts to register using an email address that belongs to someone else. We might call this use case actor the “Stalker Ex-Girlfriend/Boyfriend”

There may be many options for designing around this problem.  The point is that by documenting this misuse case, the analyst is placing the necessary emphasis on security considerations.  Undoubtedly, a number of additional use case scenarios will likely be uncovered to handle countermeasures to this behavior.