Emerging cloud applications are growing rapidly and the need for identifying and managing service requirements is also highly important and critical at present. Software Engineering and Information Systems has established techniques, methods and technology over two decades to help achieve cloud service requirements, design, development, and testing. However, due to the lack of understanding of software security vulnerabilities that should have been identified and managed during the requirements engineering phase, we have not been so successful in applying software engineering, information management, and requirements management principles that have been established for the past at least 25 years, when developing secure software systems. Therefore, software security cannot just be added after a system has been built and delivered to customers as seen in today's software applications. This paper provides concise methods, techniques, and best practice requirements management guidelines for software security and also discusses an Integrated-Secure SDLC model (IS-SDLC), which will benefit practitioners, researchers, learners, and educators. This paper illustrates our approach for a large cloud system Amazon EC2 service.Keywords: Emerging cloud services, Software Security Engineering, Software security requirements engineering, Secured Software Development, SQUARE method, BSI, Touchpoint, SDL, Requirements Management
IntroductionThere is no doubt that the cloud computing has revolutionised human lives, communications, digital economy, socialisation, and entertainment. At the same time demands for internet enabled applications grows rapidly. Almost all businesses, applications, entertainment devices, mobile devices, robots, large scale systems (aircrafts, mission control systems), safety-critical systems, medical systems, internet of things devices are internet enabled for various reasons such as online upgrade, distributed applications, team projects, and server connectivity. Therefore, there is ever growing demand for secured applications and trust. Cyber attacks are increasing continuously From spam, phishing, identify theft, and others in much larger scale attacks such as money laundering and cyber terrorism. There is a real possibility that a cyber attack could disable command systems, bring down power grids, open dam floodgates, paralyses communications and transport systems, creating mass hysteria: Any or all of which could be the precursor to terrorist or military attack. These are some of the threats since we (personal, govt. organisations, companies, and business) mostly depend on computers and mobiles for communications and management. Emerging cloud services are on the increase including eHealth Cloud, E-Learning, E-Manufacturing, etc. Kostoska, M, Gusev, M, and Ristov, S (2014) describe a new cloud protability platform (PaaS) as a service which can accept and exchange from one cloud platform to another platform and installed completely automatically. Han, G et al (2016) have proposed an energy-awar...