Secure Software Engineering: Learning from the Past to Address Future Challenges
Information Security Journal: A Global Perspective
A systematic review of security requirements engineering
Computer Standards & Interfaces
Security requirements engineering framework for software product lines
Information and Software Technology
Discovering sustainability requirements: an experience report
REFSQ'11 Proceedings of the 17th international working conference on Requirements engineering: foundation for software quality
A Unified Use-Misuse Case Model for Capturing and Analysing Safety and Security Requirements
International Journal of Information Security and Privacy
Comparing Misuse Case and Mal-Activity Diagrams for Modelling Social Engineering Attacks
International Journal of Secure Software Engineering
Securing business processes using security risk-oriented patterns
Computer Standards & Interfaces
| Hi-index | 0.00 |
Many software-intensive systems have significant safety and security ramifications and need to have their associated safety- and security-related requirements properly engineered. It has been observed by several consultants, researchers, and authors that inadequate requirements are a major cause of accidents involving software-intensives systems, and poor security requirements prevent the early incorporation of security concerns into the architecture. Yet in practice, there is very little interaction between the requirements, safety, and security disciplines and little collaboration between their respective communities. Most requirements engineers, safety engineers, and security engineers know little about their respective disciplines. Also, safety and security engineering typically concentrates on architectures and designs rather than requirements because hazard and threat analysis typically depends on the identification of hardware and software components, the failure of which can cause accidents and vulnerabilities which can enable successful attacks. This leads to safety- and security-related requirements that are often ambiguous, incomplete, unverifiable, and even missing. This tutorial begins with a single common realistic example of a safety- and security-critical system that will be used throughout to provide good examples of safety- and security-related requirements. The tutorial provides a consistent ontology of safety, security, and requirements concepts and terminology, provides clear definitions and descriptions of the different kinds of safety- and security-related requirements, and finishes with a practical consistent combined process for engineering them.