Quality Requirements Engineering Research Articles

Formulating Cybersecurity Requirements for Autonomous Ships Using the SQUARE Methodology.

Artificial intelligence (AI) technology is crucial for developing autonomous ships in the maritime industry. Autonomous ships, based on the collected information, recognize the environment without any human intervention and operate themselves using their own judgment. However, ship-to-land connectivity increased, owing to the real-time monitoring and remote control (for unexpected circumstances) from land; this poses a potential cyberthreat to various data collected inside and outside the ships and to the applied AI technology. For the safety of autonomous ships, cybersecurity around AI technology needs to be considered, in addition to the cybersecurity of the ship systems. By identifying various vulnerabilities and via research cases of the ship systems and AI technologies, this study presents possible cyberattack scenarios on the AI technologies applied to autonomous ships. Based on these attack scenarios, cyberthreats and cybersecurity requirements are formulated for autonomous ships by employing the security quality requirements engineering (SQUARE) methodology.

An Efficient Identification of Security Threats in Requirement Engineering Methodology.

Today, we completely rely on Information Technology (IT) applications for every aspect of daily life, including business and online transactions. In addition to using these IT-enabled applications for business purposes, we also use WhatsApp, Facebook, and a variety of other IT applications to communicate with others. However, there will undoubtedly be a drawback to every benefit. Since everything is linked to the Internet, there are many opportunities for security to be compromised. To address this, we are working to identify security threats early on in the software development process, specifically during the requirements phase. During the requirement engineering process, an engineer can recognize the security specifications in a more structured manner to create threat-free software. In our research work, we suggest the Identification of Security Threats during Requirement Engineering (ISTDRE) technique for detecting security risks throughout the requirement engineering process. The four points that make up this ISTDRE technique are Hack Point (HP), Speculation Point (SP), Trust Point (TP), and Reliable Point (RP). The new ISTDRE methodology will be validated using a case study of an ERP system involving two currently used methodologies: Model Oriented Security Requirements Engineering (MOSRE) and System Quality Requirements Engineering (SQUARE).

SRE_BBC: A Self-Adaptive Security Enabled Requirements Engineering Approach for SLA Smart Contracts in Blockchain-Based Cloud Systems.

Current blockchain-based cloud (BBC) systems have several security vulnerabilities regarding smart contracts (SC), and several attacks have been reported recently. The SC development lacks standard design processes that follow software lifecycle principles to model secure SC. Secondly, the security mechanisms in the SC are not constantly evolved to resist evolving adversary attacks. BBC systems lack self-adaptive security capability to make spontaneous decisions when adversarial attacks are encountered. To build a self-adaptive secure BBC system that follows standard software development lifecycle principles to model secure SC, we propose the so-called self-adaptive security RE_BBC framework. The framework would utilize the MAPE-BBC adaptation loop to make decisions internally based on the threat models, goal models, and service level agreement (SLA) SC security specifications. The framework identifies vulnerabilities and threats and takes precautionary measures using self-adaptive SC agents. We validated the proposed methodology theoretically and empirically, and statistically proved the research questions and hypothesis using the t-test and Mann–Whitney U test. Subsequently, we compare our proposed approach with the Security Quality Requirements Engineering approach (SQUARE). The feasibility results and the replicated study results indicate that the proposed approach outperformed the SQUARE approach in terms of artifacts quality, self-adaptive security evaluation quality, efficiency in response time, complexity, and usefulness of the proposed approach for the Healthcare Data Management (HDM) system. SC security developers can immensely benefit from our proposed methodology. They need not reengineer SC from scratch; depending on their security needs and plan, the contract can be adapted to execute a new plan.

Cyber Security in IoT communication (Internet of Things) on Smart Home

The Internet of Things (IoT) that are currently applied with the combination of smart devices that connect with each other devices over the Internet from smartphone to other household devices that are assembled in a smart home-based concept. Smart Home is one of the concepts of implementing IoT technology, which is the implementation of Software Engineering. However, in document requirements in its engineering process development, often the requirements for cyber security aspect is neglected because it is considered as a secondary requirement. Therefore, it will be done analysis process requirements on the system by specializing in the cyber security aspect. In this paper, it will be analyzed about cyber security requirements of smart home IoT communication using methodology of Security Quality Requirements Engineering (SQUARE). The methodology of cyber security requirements analysis use SQUARE methodology consisting of 9 stages consist of agreement, identification, development, and analysis. The identification and analysis that has been done also has resulted in security requirement along with the implementation required for a secure smart home system. The analysis result consists of four types of requirements such as Elicit Security Requirement, Categorize Requirement, Prioritize Requirement, and Requirement Inspection. It is very helpful in analyzing while providing recommendations to the security requirements of the system which are used to keep the availibility and continuity of the software as well as the integrity of the smart home systems that are being developed.

Naming the pain in requirements engineering: A design for a global family of surveys and first results from Germany

ContextFor many years, we have observed industry struggling in defining a high quality requirements engineering (RE) and researchers trying to understand industrial expectations and problems. Although we are investigating the discipline with a plethora of empirical studies, they still do not allow for empirical generalisations. ObjectiveTo lay an empirical and externally valid foundation about the state of the practice in RE, we aim at a series of open and reproducible surveys that allow us to steer future research in a problem-driven manner. MethodWe designed a globally distributed family of surveys in joint collaborations with different researchers and completed the first run in Germany. The instrument is based on a theory in the form of a set of hypotheses inferred from our experiences and available studies. We test each hypothesis in our theory and identify further candidates to extend the theory by correlation and Grounded Theory analysis. ResultsIn this article, we report on the design of the family of surveys, its underlying theory, and the full results obtained from Germany with participants from 58 companies. The results reveal, for example, a tendency to improve RE via internally defined qualitative methods rather than relying on normative approaches like CMMI. We also discovered various RE problems that are statistically significant in practice. For instance, we could corroborate communication flaws or moving targets as problems in practice. Our results are not yet fully representative but already give first insights into current practices and problems in RE, and they allow us to draw lessons learnt for future replications. ConclusionOur results obtained from this first run in Germany make us confident that the survey design and instrument are well-suited to be replicated and, thereby, to create a generalisable empirical basis of RE in practice.

System Security Requirements Analysis:A Smart Grid Case Study

ABSTRACTOne of the main concerns in development and operation of mission‐critical systems is system security. It is of critical importance to properly specify and implement system security requirements. In this paper, we apply a system security requirements analysis method to elicit, specify, categorize, and prioritize the system security requirements on the smart grid as a complex system‐of‐systems case study. In particular, we apply the Security Quality Requirements Engineering (SQUARE) method as a representative system security requirements analysis method. The main contributions of this research are the smart grid customer domain security requirements specification and its analysis from the system‐of‐systems perspective. We elicited a large proportion of system and system‐of‐systems vulnerabilities and requirements, and used them to specify secure smart grid intersystem interactions.

Measuring Security in Requirements Engineering

The aim of this paper is to measure the security and related verification method in requirements engineering (RE). There are a few existing approaches to measure RE performance like IEEE Software Requirements Specification (SRS) and Security Quality Requirements Engineering (SQUARE). However, these existing approaches have some limitations such as lack of flexibility and require long implementation period. In order to address these issues, this paper intends to propose a new set of tools. First is the Effective Security Check List (ESCL), which is a check list with security questions that should be considered for measuring security. Secondly, the Traceability Matrix(TM), which is a two dimensional matrix to measure security during RE. Thirdly, Requirement Engineering Assessment Document (READ), which is a tool containing all statistical information about security performance during RE. The combination of presented approaches had been implemented in a case study. The outcome results are encouraging and illustrated integrated outcomes within existing RE model. The security level had also been properly measured. DOI: http://dx.doi.org/10.11591/ij-ict.v1i2.695

Eliciting and prioritizing quality requirements supported by ontologies: a case study using the ElicitO framework and tool

AbstractAs software complexity grows and clients demand higher quality software, quality requirements can no longer be considered to be of secondary importance. Thus, eliciting, specifying, prioritizing and validating quality requirements is a prerequisite to the development of effective and efficient information systems. Despite the critical importance of quality requirements, there is a considerable gap in the breadth and depth of quality requirements engineering (RE) support in most RE approaches. In practice, it is often the case to have quality requirements considered as an afterthought in the systems development process. While there is a wealth of modelling techniques and tools for functional requirements, there is very limited support for quality requirements in RE. Support for quality requirements is usually ad‐hoc, without clear guidelines on how to capture, specify and manage quality requirements and also without proper usage of standardized terminologies based on established quality models such as the ISO/IEC 9126 quality model. In this paper, we discuss a quality‐driven RE framework and tool that applies knowledge management techniques and quality ontologies to support RE activities. The ontology implements the quality characteristics and metrics prescribed by the ISO/9126 quality model, providing a common vocabulary to address quality concerns/aspects across RE activities. We empirically validate how the framework and tool can be used to effectively support the requirements elicitation and prioritization activities through a case study addressing the development of an intranet portal project at the University of Manchester.

Evaluating the effectiveness of the security quality requirements engineering (SQUARE) method: a case study using smart grid advanced metering infrastructure

This paper presents an evaluation of the security quality requirements engineering (SQUARE) method. The evaluation of SQUARE was conducted by its application on the advanced metering infrastructure of smart grid as a case study. We evaluated the effectiveness of SQUARE with respect to its ability to elicit a set of artifacts, threats, and vulnerabilities; to perform likelihood, impact analysis, and risk level determination; and to elicit, categorize, and prioritize the security requirements. The main contribution of this work is the evaluation of the effectiveness of SQUARE using qualitative security requirements engineering method evaluation criteria.

Integrating privacy requirements considerations into a security requirements engineering method and tool

In this paper we examine a method for identifying privacy requirements within the context of a security requirements engineering method. We briefly describe the security quality requirements engineering (SQUARE) methodology. Next we discuss our definition of privacy and the associated privacy concerns. We discuss the challenges of privacy requirements engineering and the need for incorporating privacy considerations into security requirements engineering approaches. We describe a novel modification to the SQUARE method and tool to incorporate privacy considerations, and identify future work that will lead to a more integrated method for security and privacy requirements engineering.

Benefits and Challenges in the Use of Case Studies for Security Requirements Engineering Methods

The premise of this article is that pilot case studies in security requirements engineering provide both benefits and challenges to the underlying research, education, and technology transition effort. Over the past four years we have worked with seven development groups in five organizations in the process of refining and transitioning the Security Quality Requirements Engineering (SQUARE) and SQUARE-Lite methods into practice. These experiences have provided the opportunity to step back and assess the use of pilots in conjunction with student projects to support method refinement and technology transition. Although SQUARE and SQUARE-Lite are concerned with security requirements, the benefits and challenges that have been observed would apply to many security research and technology transition efforts. We itemize and justify these benefits and challenges and discuss their practical relevance and application to ensuring adequate information assurance protection.

MOQARE: misuse-oriented quality requirements engineering

This work presents MOQARE (misuse-oriented quality requirements engineering), a method to explore quality requirements. The aim of MOQARE is to support intuitive and systematic identification of qu...

Security quality requirements engineering (SQUARE) methodology

Requirements engineering, a vital component in successful project development, often neglects sufficient attention to security concerns. Further, industry lacks a useful model for incorporating security requirements into project development. Studies show that upfront attention to security saves the economy billions of dollars. Industry is thus in need of a model to examine security and quality requirements in the development stages of the production lifecycle.In this paper, we examine a methodology for both eliciting and prioritizing security requirements on a development project within an organization. We present a model developed by the Software Engineering Institute's Networked Systems Survivability (NSS) Program, and then examine two case studies where the model was applied to a client system. The NSS Program continues to develop this useful model, which has proven effective in helping an organization understand its security posture.