A Systematic Mapping Study on Security in Agile Requirements Engineering

Abstract

Background] The rapidly changing business environments in which many companies operate is challenging traditional Requirements Engineering (RE) approaches. This gave rise to agile approaches for RE. Security, at the same time, is an essential non-functional requirement that still tends to be difficult to address in agile development contexts. Given the fuzzy notion of "agile" in context of RE and the difficulties of appropriately handling security requirements, the overall understanding of how to handle security requirements in agile RE is still vague. [Objective] Our goal is to characterize the publication landscape of approaches that handle security requirements in agile software projects. [Method] We conducted a systematic mapping to outline relevant work and contemporary gaps for future research.[Results] In total, we identified 21 studies that met our inclusion criteria, dated from 2005 to 2017. We found that the approaches typically involve modifying agile methods, introducing new artifacts (e.g., extending the concept of user story to abuser story), or introducing guidelines to handle security issues. We also identified limitations of using these approaches related to environment, people, effort and resources.[Conclusion] Our analysis suggests that more effort needs to be invested into empirically evaluating the existing approaches and that there is an avenue for future research in the direction of mitigating the identified limitations.

Management of quality requirements in agile and rapid software development: A systematic mapping study

“…Table 1 presents these studies in chronological order. However, most of these secondary studies (except the studies performed by Alsaqaf et al [10] and Villamizar et al [22]) have primarily reported on functional requirements, and QRs are only a marginal topic in their primary studies (see the third column in Table 1. In addition, the search strategies of existing secondary studies are not targeted at studies on QRs.…”

“…Except Alsaqaf et al [10] and Villamizar et al [22], existing secondary studies only superficially discuss QRs, or do not discuss them at all. Some highlight the limitations of agile methods when managing QRs and the risks of neglecting QRs [11,[16][17][18]21], and some identify strategies for managing QRs in ASD, such as the AFFINE framework, NORMAP, and SENoR [11].…”

“…For instance, Alsaqaf et al [9] reported that only 29 of the 60 primary studies they identified were empirical in nature. Villamizar et al [22], reported 21 empirical studies. One reason for this difference may be the snowballing search strategy we applied, which revealed a relatively large number of primary studies.…”

“…Villamizar et al [22] identified approaches for handling security in ASD that introduce artifacts such as abuser story, present approach for integrating security in Scrum, methods such as NORMAP [S48], and NERV [S42], and NORMATIC tool [S48, S50], and guidelines for eliciting and documenting QRs [S132, 156], that are included in our findings. They also reported a way for mapping security activities into Dynamic System Development Method (DSDM) [67] that was not found in our study.…”

“…While there are secondary studies [10,11,[16][17][18][19][20][21][22] that examine state-of-the-art of requirements engineering (RE) in the context of ASD, only Alsaqaf et al [10] and Villamizar et al [22] specifically focused on QRs. However, Alsaqaf et al [10] did so only in the context of large-scale ASD, whereas Villamizar et al [22] examined only how security is handled in ASD. Existing secondary studies of RSD [8,[23][24][25] also do not specifically focus on QRs.…”