VIEW POINT APPROACH FOR ENGINEERING SECURITY REQUIREMENTS

Abstract

Requirements elicitation for a new system requires extensive involvement with stakeholders who usually have varying aims, backgrounds and disciplines, and this process is complicated further if the system has critical security, or other non-functional requirements. Established approaches to the elicitation and analysis of functional and non- functional requirements are very different, the former focusing on boundary behavior and the later on threats to assets. The development of functional requirements focuses on how a system interacts with its environment, while the development of security requirements focuses on risk, in particular the risk of particular unwanted outcomes to the business, and its assets. Functional requirements are clearly behavior-led, whereas security requirements are asset driven. As a consequence these processes are rarely fully combined; security is often dealt after the requirement engineering process. As a result of this the requirement engineer en...