Increasing Trustworthiness through Security Testing Support

Abstract

Trustworthiness is an essential and sometimes life-critical concern in software-intensive systems. Furthermore, supporting the proper testing of these systems can often times prove complicated. Within trustworthiness, security and privacy play key roles. Considering both security and privacy issues early in development are necessary to increase the trustworthiness of systems. In this paper we concentrate on the security aspect of trustworthiness. We believe that proper capture of software security starts at requirements and carries forward throughout system development, especially into testing. While a variety of techniques for specifying security requirements exist, there is a tangible lack of support for making security requirements useful during testing. In this paper we present testing capabilities of a new security requirements engineering technique called SURE, Secure and Usable Requirements Engineering. SURE focuses on the mapping of security requirements into testing artifacts using a specialized syntax. We also present results from a usability study of our technique’s testing capabilities; the study confirmed that participants were able to map testing artifacts from security requirements with increased understanding and confidence, which could potentially lead to improved trustworthiness.