Analysis of Security Requirements Engineering: Towards a Comprehensive Approach

Abstract

Abstract-Software's security depends greatly on how a system was designed, so it's very important to capture security requirements at the requirements engineering phase. Previous research proposes different approaches, but each is looking at the same problem from a different perspective such as the user, the threat, or the goal perspective. This creates huge gaps between them in terms of the used terminology and the steps followed to obtain security requirements. This research aims to define an approach as comprehensive as possible, incorporating the strengths and best practices found in existing approaches, and filling the gaps between them. To achieve that, relevant literature reviews were studied and primary approaches were compared to find their common and divergent traits.To guarantee comprehensiveness, a documented comparison process was followed. The outline of our approach was derived from this comparison. As a result, it reconciles different perspectives to security requirements engineering by including: the identification of stakeholders, assets and goals, and tracing them later to the elicited requirements, performing risk assessment in conformity with standards and performing requirements validation. It also includes the use of modeling artifacts to describe threats, risks or requirements, and defines a common terminology.

Experimental Evaluation of Security Requirements Engineering Benefits

“…The goal of this paper is to make such a quantitative evaluation by developing two versions of the same web application, with and without using an SRE approach and evaluating their levels of security. The SRE approach that will be used is CompaSRE, a proprietary approach detailed in previous work [2]. For evaluation purposes, there's a plethora of testing methods and tools that could be used.…”

Modeling Security Requirements: Extending SysML with Security Requirements Engineering Concepts

“…In previous work [1], we did a thorough analysis of existing security requirements engineering approaches. We proposed the outline for a comprehensive approach (hereafter referred to as CompASRE), incorporating the strengths and best practices found in existing approaches, and filling the gaps between them.…”