Abstract
Most Secure Development Software Life Cycles (SSDLCs) start from security requirements. Security Management standards do likewise. There are several methods from industry and academia to elicit and analyze security requirements, but there are few empirical evaluations to investigate whether these methods are effective in identifying security requirements. Most of the papers published in the requirements engineering community report on methods’evaluations that are conducted by the same researchers who have designed the methods.
The goal of this paper is to investigate how successfull academic security requirements methods are when applied by someone different than the method designer. The paper reports on a medium scale qualitative study where master students in computer science and professionals have applied academic security requirements engineering methods to analyze the security risks of a specific application scenario. The study has allowed the identification of methods’ strenghts and limitations.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
Healthcare Collaborative Network Solution Planning and Implementation. Vervante (2006)
Asnar, Y., Giorgini, P., Massacci, F., Saidane, A., Bonato, R., Meduri, V., Ricucci, V.: Secure and dependable patterns in organizations: An empirical approach. In: Proc. of RE 2007, pp. 287–292 (2007)
Condori-Fernandez, N., Daneva, M., Sikkel, K., Wieringa, R., Dieste, O., Pastor, O.: A systematic mapping study on empirical evaluation of software requirements specifications techniques. In: Proc. of ESEM 2009, pp. 502–505 (2009)
Giorgini, P., Massacci, F., Mylopoulos, J., Zannone, N.: Modeling security requirements through ownership, permission and delegation. In: Proc. of RE 2005, pp. 167–176 (2005)
Grondahl, I.H., Lund, M.S., Stolen, K.: Reducing the effort to comprehend risk models: Text labels are often preferred over graphical means. Risk Analysis 31(11), 1813–1831 (2011)
Haley, C., Laney, R., Moffett, J., Nuseibeh, B.: Security requirements engineering: A framework for representation and analysis. IEEE Transactions on Software Engineering 34(1), 133–153 (2008)
Heyman, T., Yskout, K., Scandariato, R., Joosen, W.: An analysis of the security patterns landscape. In: Proc. of the 3rd Int. Workshop on Soft. Eng. for Secure Systems, SESS 2007, p. 3. IEEE Computer Society (2007)
Hogganvik, I., Stølen, K.: A Graphical Approach to Risk Identification, Motivated by Empirical Investigations. In: Wang, J., Whittle, J., Harel, D., Reggio, G. (eds.) MoDELS 2006. LNCS, vol. 4199, pp. 574–588. Springer, Heidelberg (2006)
ITGI. CoBIT - Framework Control Objectives Management Guidelines Maturity Models, 4.1Â ed. The IT Governance Institute (2007)
Jürjens, J.: UMLsec: Extending UML for Secure Systems Development. In: Jézéquel, J.-M., Hussmann, H., Cook, S. (eds.) UML 2002. LNCS, vol. 2460, pp. 412–425. Springer, Heidelberg (2002)
Lodderstedt, T., Basin, D., Doser, J.: SecureUML: A UML-Based Modeling Language for Model-Driven Security. In: Jézéquel, J.-M., Hussmann, H., Cook, S. (eds.) UML 2002. LNCS, vol. 2460, pp. 426–441. Springer, Heidelberg (2002)
Lund, M.S., Solhaug, B., Stolen, K.: A guided tour of the coras method. In: Model-Driven Risk Analysis, pp. 23–43. Springer (2011)
McGraw, G., Chess, B., Migues, S.: Building Security In Maturity Model (BSIMM3), 3rd edn. Cigital Inc. (2011)
Mead, N.R., Stehney, T.: Security quality requirements engineering (square) methodology. SIGSOFT Softw. Eng. Notes 30(4), 1–7 (2005)
Microsoft Security Development Life Cycle. Microsft sdl website (2011), http://www.microsoft.com/security/sdl/default.aspx
Mouratidis, H., Giorgini, P., Manson, G.: Integrating Security and Systems Engineering: Towards the Modelling of Secure Information Systems. In: Eder, J., Missikoff, M. (eds.) CAiSE 2003. LNCS, vol. 2681, pp. 1031–1031. Springer, Heidelberg (2003)
NIST Comp. Security Division. Recommended security controls for federal information systems and organizations. Tech. Rep. 800-53, U.S. Nat. Inst. of Standards and Technology, Rev. 3 (2009)
Opdahl, A.L., Sindre, G.: Experimental comparison of attack trees and misuse cases for security threat identification. Inf. Softw. Technol. 51(5), 916–932 (2009)
Potts, C.: Software-engineering research revisited. IEEE Softw. 10(5), 19–28 (1993)
The Open Web Application Security Project. Owasp website (2011), http://www.owasp.org
Yskout, K., Scandariato, R., Joosen, W.: Change patterns: Co-evolving requirements and architecture. Soft. and Sys. Modeling J. (2012)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2012 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Massacci, F., Paci, F. (2012). How to Select a Security Requirements Method? A Comparative Study with Students and Practitioners. In: Jøsang, A., Carlsson, B. (eds) Secure IT Systems. NordSec 2012. Lecture Notes in Computer Science, vol 7617. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-34210-3_7
Download citation
DOI: https://doi.org/10.1007/978-3-642-34210-3_7
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-34209-7
Online ISBN: 978-3-642-34210-3
eBook Packages: Computer ScienceComputer Science (R0)