Abstract
Secure software systems are crucial in today’s digital world, where there is an ever-increasing amount of IT systems, leading to more risks of exposing sensitive data and service outages. One of the key aspects of secure software development is ensuring that security requirements are met through the various stages of software development. The process of testing security requirements is often complex and time-consuming, notably because of the gap between the verification process of security requirements and the testing process. To address this issue and simplify the testing of security requirements, this paper proposes to use the Requirements as Code approach (RQCODE). RQCODE combines security requirements with code in a way to support automated testing and continuous verification of security requirements throughout the software development life cycle. This paper contributes to the field of software security by providing a practical and effective approach to bridge the gap between verification of security requirements and testing, ultimately leading to more secure software systems. Additionally, it discusses the benefits of this approach, such as its ability to improve the accuracy and consistency of testing, enabling the early detection of security issues, and reducing the time and effort required for security testing. It also discusses the challenges and limitations of the approach.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
References
Adzic, G.: Specification by Example: How Successful Teams Deliver the Right Software. Manning Publications (2011)
Regulation, General Data Protection: General data protection regulation (GDPR) - official legal text (2023). https://gdpr-info.eu. Accessed 11 July 2023
PCI Security Standards Council: Official PCI security standards (2023). https://www.pcisecuritystandards.org/. Accessed 15 May 2023
DoD Cyber Exchange: Security technical implementation guides (STIGs) - DoD cyber exchange (2023). https://public.cyber.mil/stigs/. Accessed 5 July 2023
Franke, U., Brynielsson, J.: Cyber situational awareness - a systematic review of the literature. Comput. Secur. 46, 18–31 (2014). https://doi.org/10.1016/j.cose.2014.06.008. https://www.sciencedirect.com/science/article/pii/S0167404814001011
Frontiers: ISO/IEC 27034-1:2011 (2023). https://www.iso.org/standard/44378.html. Accessed 20 Apr 2023
Frontiers: Windows 10 Security Technical Implementation Guide - DoD cyber exchange (2023). https://www.stigviewer.com. Accessed 23 MAy 2023
Gross, D., Yu, E.: From non-functional requirements to design through patterns. Requirements Eng. 6(1), 18–36 (2001)
Ismaeel, K., Naumchev, A., Sadovykh, A., Truscan, D., Enoiu, E.P., Seceleanu, C.: Security requirements as code: Example from VeriDevOps project. In: 2021 IEEE 29th International Requirements Engineering Conference Workshops (REW), pp. 357–363. IEEE (2021)
Jürjens, J.: Secure Systems Development with UML. Springer, Berlin (2005). https://doi.org/10.1007/b137706
Mead, N.R., Stehney, T.: Security quality requirements engineering (SQUARE) methodology. ACM SIGSOFT Softw. Eng. Not. 30, 1–7 (2005)
Mellado, D., Blanco, C., Sánchez, L.E., Fernández-Medina, E.: A systematic review of security requirements engineering. Comput. Stand. Interfaces 32(4), 286–295 (2010)
Mukherjee, S., Roy, S., Bose, R.: Defining an appropriate trade-off to overcome the challenges and limitations in software security testing. J. Xidian Univ. 14(2), 1471–1479 (2020)
Naumchev, A.: Seamless object-oriented requirements. In: 2019 International Multi-Conference on Engineering, Computer and Information Sciences (SIBIRCON), pp. 0743–0748. IEEE (2019)
Nigmatullin, I., Sadovykh, A., Messe, N., Ebersold, S., Bruel, J.M.: RQCODE-towards object-oriented requirements in the software security domain. In: 2022 IEEE International Conference on Software Testing, Verification and Validation Workshops (ICSTW), pp. 2–6. IEEE (2022)
Pressman, R.S.: Software Engineering: A Practitioner’s Approach, European edn. McGraw-Hill (1994). Adapted by Darrel Ince
Sindre, G., Opdahl, A.L.: Eliciting security requirements with misuse cases. Requirements Eng. 10(1) (2005). https://doi.org/10.1007/s00766-004-0194-4
Smart, J.: BDD in Action: behavior-driven development for the whole software lifecycle. Manning (2014)
Software: Behaviour-driven development - Cucumber documentation (2023). https://cucumber.io/docs/bdd/. Accessed 1 May 2023
Team: Secure product design - OWASP cheat sheet series (2023). https://cheatsheetseries.owasp.org/. Accessed 2 July 2023
Tian-yang, G., Yin-Sheng, S., You-yuan, F.: Research on software security testing. In. J. Comput. Inf. Eng. 4(9), 1446–1450 (2010)
Tooke, S.: The Cucumber Book: Behaviour-Driven Development for Testers and Developers. The Pragmatic Bookshelf (2017)
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2023 IFIP International Federation for Information Processing
About this paper
Cite this paper
Nigmatullin, I., Sadovykh, A., Ebersold, S., Messe, N. (2023). RQCODE: Security Requirements Formalization with Testing. In: Bonfanti, S., Gargantini, A., Salvaneschi, P. (eds) Testing Software and Systems. ICTSS 2023. Lecture Notes in Computer Science, vol 14131. Springer, Cham. https://doi.org/10.1007/978-3-031-43240-8_9
Download citation
DOI: https://doi.org/10.1007/978-3-031-43240-8_9
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-031-43239-2
Online ISBN: 978-3-031-43240-8
eBook Packages: Computer ScienceComputer Science (R0)
