Holistic security requirement engineering for electronic commerce

Abstract

With the introduction of electronic commerce, business is becoming dependent on information systems in a new way. Information security is thus becoming more and more important to companies' self-protection. In contrast to previous systems, this is also directly visible to the customer. The changing situation means, however, that the requirements for security cannot be solely filled by new policies and risk analysis. This article proposes an approach called “holistic security requirement engineering” meant to elicit security requirements according to system-theoretic considerations. It will show that security requirements can be defined with the help of investigations in the business environment, workshops with stakeholders and risk analysis. This multidimensional approach will lead to a holistic understanding of the requirements that fit into the system development life cycles.