Authors:
Roman Wirtz
1
;
Maritta Heisel
1
;
Rene Meis
1
;
Aida Omerovic
2
and
Ketil Stølen
2
Affiliations:
1
University of Duisburg-Essen, Germany
;
2
SINTEF Institute, Norway
Keyword(s):
Risk Management, Security, Requirements Engineering, Problem-based, Model-based.
Related
Ontology
Subjects/Areas/Topics:
Artificial Intelligence
;
Cross-Feeding between Data and Software Engineering
;
Knowledge Management and Information Sharing
;
Knowledge-Based Systems
;
Model-Driven Engineering
;
Requirements Engineering
;
Software Engineering
;
Software Engineering Methods and Techniques
;
Symbolic Systems
Abstract:
Security is of great importance for many software systems. The security of a software system can be compromised by threats, which may harm assets with a certain likelihood, thus constituting a risk. All such risks should be identified, and unacceptable risks should be reduced, which gives rise to security requirements. The relevant security requirements should be known right from the beginning of the software development process. Eliciting security requirements should be done in a systematic way. We propse a method to elicit security requirements that address unacceptable risks. They require a reduction of the risk to an acceptable level. Our method combines the CORAS risk management method with Jackson’s problem-based requirements analysis approach. Based on the functional requirements for a software system, security risks are identified and evaluated. Unacceptable risks give rise to high-level security requirements. To reduce the risk, treatments are selected. Based on the selected
treatments, concretized security requirements are set up and represented in a similar way as functional requirements. Thus, both functional and security requirements can then drive the software development process.
(More)