Capturing security requirements for software systems

Abstract

Security is often an afterthought during software development. Realizing security early, especially in the requirement phase, is important so that security problems can be tackled early enough before going further in the process and avoid rework. A more effective approach for security requirement engineering is needed to provide a more systematic way for eliciting adequate security requirements. This paper proposes a methodology for security requirement elicitation based on problem frames. The methodology aims at early integration of security with software development. The main goal of the methodology is to assist developers elicit adequate security requirements in a more systematic way during the requirement engineering process. A security catalog, based on the problem frames, is constructed in order to help identifying security requirements with the aid of previous security knowledge. Abuse frames are used to model threats while security problem frames are used to model security requirements. We have made use of evaluation criteria to evaluate the resulting security requirements concentrating on conflicts identification among requirements. We have shown that more complete security requirements can be elicited by such methodology in addition to the assistance offered to developers to elicit security requirements in a more systematic way.

Securing Web Applications through a Framework of Source Code Analysis

“…This practical approach is currently adopted by most of the security practitioners. In essence, the integration of security strategies as a security framework while writing the source code would allow any security anomalies to be detected and fixed well before the software application is released (El-Hadary and El-Kassas, 2014). The framework will also allow the code to be audited for conformance which, as a result, will not only provide greater security but will also save time, costs and resources which might be incurred on redevelopment or patching of the software application once it is released.…”

Quality Assurance of Security Requirement Engineering in Socio- Technical Systems

“…Security and integrity was the key issue handled but it lacked reliability. H.El-Hadary et al [13] describes a methodology in which security catalog is made with the help of previous security knowledge. This methodology based on reusing of previous knowledge.…”

Investigating Agile Requirements Engineering Practices in the South African Software Development Market

“…The questions were carefully crafted to explore Agile RE practices and developed in accordance with the study aim. The issues chosen for the interviews were outlined in the literature review in studies such as [3,4,8,10,15,18,20,27].…”

“…Assess the risk for the project if the requirement is implemented. [4] requirements to protect the system from potential attacks [8]. These frameworks vary in how security requirements are derived.…”

“…Researchers agree that there is a lack of empirical studies on how companies are conducting RE in Agile Software Development and much more research is required in this critical area [4,8,9,10]. In order to close the research gap, there is a need to conduct an in-depth analysis of Agile RE practices to assess their impact on the development of high quality software apps that are safe to use.…”