Getting Grip on Security Requirements Elicitation by Structuring and Reusing Security Requirements Sources

Abstract

Abstract. This paper presents a model for structuring and reusing security requirements sources. The model serves as blueprint for the development of an organization-specific repository, which provides relevant security requirements sources, such as security information and knowledge sources and relevant compliance obligations, in a structured and reusable form. The resulting repository is intended to be used by development teams during the elicitation and analysis of security requirements with the goal to understand the security problem space, incorporate all relevant requirements sources, and to avoid unnecessary effort for identifying, understanding, and correlating applicable security requirements sources on a project-wise basis. We start with an overview and categorization of important security requirements sources, followed by the description of the generic model. To demonstrate the applicability and benefits of the model, the instantiation approach and details of the resulting repository of security requirements sources are presented.

Tracing security requirements in industrial control systems using graph databases

“…Also, [34] finds out that most of the requirements reuse techniques are textual copy based and that there is a direct relationship between the requirements reuse and the adopted technology. Moreover, methods that extensively adopt requirements repositories such as [20,40,53] use them to construct requirement specification documents. The repository usability reduces at the design and implementation stage due to the manual linkages of the requirements.…”

A Method for Software Requirement Volatility Analysis Using QFD

“…The model, e.g. has been used to develop the security requirements and the architectural specifications concurrently [16]. The study shows that the requirement elicitation and architectural design activities should not be performed sequentially in a single phase within the development life cycle.…”