Security Requirements Elicitation Research Articles

Expediting the design and development of secure cloud-based mobile apps

The adoption and popularity of mobile devices by end-users is partially driven by the increasing development and availability of mobile applications that can aid solving different problems and provide access to services in a wide range of domains or categories, namely healthcare, education, e-commerce or entertainment. While these applications use and benefit from the combination of a wide panoply of technologies from the Internet of Things, fog and cloud computing, data security and privacy are typically not fully taken into account before the creation of many mobile applications or during the software development phases. This paper presents an in-depth approach to modeling attacks on the specific cloud and mobile ecosystem, given its importance in the process of secure application development. Moreover, aiming at bridging the knowledge gap between developers and security experts, this paper presents an alpha version of the security by design for cloud and mobile ecosystem (secD4CloudMobile) framework. secD4CloudMobile is a set of tools that covers cloud and mobile security requirement elicitation (CMSRE), cloud and mobile security best practices guidelines (CMSBPG), cloud mobile attack modeling elicitation (CMAME), and cloud mobile security test specification and tools (CM2ST). The purpose of the framework is to provide cloud and mobile application developers useful readily applicable information and guidelines, striving to bring security engineering and software engineering closer, in a more accessible and automated manner, aiming at the incorporation of security by construction. Finally, the paper presents some preliminary results and discussion.

Software Development Teams Knowledge and Awareness of Security Requirement Engineering and Security Requirement Elicitation and Analysis

Software security is a concern due to software's pervasiveness and how rapid software's are developed. Although studies have emphasized the importance of addressing security requirements during the early phases of requirement engineering, it is often overlooked. This oversight may stem from limited knowledge and awareness among software development teams regarding security requirement engineering (SRE) and security requirement elicitation analysis (SREA). To assess this, a quantitative study was conducted. Respondents completed a survey, and the data was analysed using descriptive statistics. The results indicate that software development teams possessed an average knowledge of SRE but demonstrated good knowledge of SREA.

Re-evaluation of PhishI game and its utilisation in eliciting security requirements

Re-evaluation of PhishI game and its utilisation in eliciting security requirements

Re-Evaluation of PhishI Game and its utilization in Eliciting Security Requirements

Re-Evaluation of PhishI Game and its utilization in Eliciting Security Requirements

Assessing frameworks for eliciting privacy & security requirements from laws and regulations

The processing of personal data has become a prominent concern for stakeholders when selecting software or service providers to serve their needs. Different laws and legislation have been introduced to standardize and strengthen data protection policies across different countries to protect such data. Therefore, businesses and organizations responsible for managing personal data are obligated to implement the privacy and security requirements established by these laws and legislation. Different methods and tools have been provided for eliciting requirements for legally compliant software based on the relevant data protection laws and legislation. However, little has been done in assessing these methodologies on regulations outside the EU and the US. This paper aims to assess these methodologies on other information security laws and regulations beyond the General Data Protection Regulation (GDPR) and Health Insurance Portability and Accountability Act (HIPAA) by eliciting security requirements explicitly focusing on the Nigerian data protection regulation. To investigate the applicability of these methodologies, we use the extracted privacy and security requirements with information communication protocols in verifying compliance in procedural practices of products and services in the financial technology sector. The analysis reports on the completeness, consistency, and utility of the frameworks. Finally, foundational research directions for interoperable standards for eliciting software requirements from legal texts are proposed.

Performance evaluation of the SRE and SBPG components of the IoT hardware platform security advisor framework

The applications of Internet of Things (IoT) and associated technologies have been spreading rapidly across a wide range of domains, including environmental monitoring, home automation, and supply chain, having a significant bearing on the social and economic well-being of humans as well as enhancing environmental sustainability. In recent years, however, there have been several data breaches and other security and privacy incidents involving IoT devices, which have attracted significant attention from the research community in both academia and industry. This has resulted in a surge of proposals put forward by many researchers, including IoT blockchain-based security solutions, IoT intrusion detection systems, IoT authentication systems, and IoT security analytics. While these proposals are aimed at addressing various IoT security and privacy-related issues, many of these solutions arguably seem not to focus on helping designers and developers with little or no security expertise in start-up companies to produce secure IoT systems. To this end, the IoT Hardware Platform Security Advisor (IoT-HarPSecA) framework was proposed to foster the design and implementation of secure IoT systems. In this paper, we present the performance and usability evaluation of the Security Requirements Elicitation (SRE) and Security Best Practice Guidelines (SBPG) component tools of IoT-HarPSecA, which are two of the three component tools of the security framework. Results show that the two components of the IoT-HarPSecA framework can facilitate the development of secure IoT systems and that the SRE and SBPG tools are easy to use.

Prove the Importance of MOSRE Framework to Elicit Security Requirements at Early Stages of SDLC to Minimize Vulnerabilities at Later Phases in Developing Web Applications

Prove the Importance of MOSRE Framework to Elicit Security Requirements at Early Stages of SDLC to Minimize Vulnerabilities at Later Phases in Developing Web Applications

SafeSec Tropos: Joint security and safety requirements elicitation

The growing convergence of information technology with operational technology and the accordant proliferation of interconnected cyber-physical systems (CPSs) has given rise to several security and safety challenges. One of these refers to systematically identifying coherent, consistent, and non-conflicting security and safety requirements. This paper proposes an integrated method for safety and security requirements engineering for CPSs at the design stage of the system lifecycle. The method identifies security and safety objectives, it systematically elicits a comprehensive list of requirements, and it links these requirements to objectives, thus facilitating the process of resolving conflicts. To provide insight into the operations of the method, we demonstrate its use to the most vulnerable CPSs on board the Cyber-Enabled Ship (C-ES). By utilizing the proposed method, the safety and security objectives of these systems were defined, and their safety and security requirements were identified.

Quantitative Analysis of Requirement Elicitation Techniques through FANP: Security Perspective

The last few decades have shown an incredible rise in the production of different types of software according to the user’s needs. Requirement Elicitation techniques for security requirements are one of the most crucial stage of software development life cycle. Based on the Analytical Network Process (ANP) process, this paper analyzes the weighting of elicitation techniques for security requirements in the production of software applications. In other words, the elicitation strategies of security requirements play an important role in the development of secure software. It also analyzes the relationship between security requirement elicitation techniques and their objectives through the use of ANP method and also demonstrates the application of fuzzy ANP method to achieve higher accuracy. When developing a secure software framework, the results provide a better platform. With these facts in mind, the proposed study will also clarify the priority weights of security requirement elicitation techniques that can be used to analyze trade-offs between competing software security requirement elicitation techniques and provide a new way for developers when constructing the secure software.

IoT-HarPSecA: A Framework and Roadmap for Secure Design and Development of Devices and Applications in the IoT Space

The past couple of years have marked continued growth in the applications and services of the Internet of Things (IoT). This has attracted the attention of new operators as well as institutional, corporate, and private investors in every sector of the economy, and as a result, new businesses are springing up rapidly. These include many start-up companies that are producing various kinds of useful IoT devices and Smart Applications (smart apps). While this can be seen as a boost for innovation in the IoT, some of these companies produce IoT devices and smart apps with security vulnerabilities. In this paper, we propose the IoT Hardware Platform Security Advisor (IoT-HarPSecA), a security framework intended to provide support to such IoT producers. IoT-HarPSecA offers three functionality features, namely security requirement elicitation, security best practice guidelines for secure development, and above all, a feature that recommends specific LightWeight Cryptographic Algorithms (LWCAs) for both software and hardware implementations. Accordingly, IoT-HarPSecA is composed of three main components, namely Security Requirements Elicitation (SRE) component, Security Best Practice Guidelines (SBPG) component, and LightWeight Cryptographic Algorithms Recommendation (LWCAR) component, each of them servicing one of the aforementioned features. We implement a command-line tool in C++ to serve as an interface between users and the proposed framework. IoT-HarPSecA can be employed during the early stages of IoT systems design, and it can also be used to facilitate the implementation of security in existing IoT systems. This paper presents a detailed description, design, and implementation of the SRE, SBPG, and LWCAR components of the proposed framework. Using real-world practical scenarios, we show how IoT-HarPSecA can be used to elicit security requirements and recommend appropriate LWCAs based on user inputs. While a full performance evaluation of the SRE and SBPG components is beyond the scope of this paper, we present a detailed performance evaluation of the LWCAR component, which shows that IoT-HarPSecA can serve as a roadmap for secure IoT development.

Recommending Security Requirements for the Development of Android Applications Based on Sensitive APIs

App stores allow anyone to sell his products to millions of potential users. However, limited by the resources and time, some developers often focus on the functionalities of their Apps without well-rounded considering security problems, which are more and more important for a successful product. In this paper, we propose an approach to help developers elicit security requirements by recommending related information gained from existing Apps in the marketplace. Firstly, we construct a feature framework to summarize functionalities of Apps by mining their descriptions with the method proposed in our previous work. Then, the sensitive APIs used in these Apps are extracted from their APK files and mapped with App features. Finally, we establish relationships between permissions and functionalities by taking sensitive APIs as a bridge, and design a recommendation framework to show information according to developers' demands from two aspects: the security requirements for the whole App and the ones for the given functionality. We evaluate our approach with 580 Apps from 5 categories on Google Play. The results confirm the usefulness of our approach, especially it can help new developers without experience initialize the security requirements and give mature developers supplementary information to elicit security requirements completely.

STORE: Security Threat Oriented Requirements Engineering Methodology

As we are continuously depending on information technology applications by adopting electronic channels and software applications for our business, online transaction and communication, software security is increasingly becoming a necessity and more advanced concern. Both the functional and non-functional requirements are important and provide the necessary needs at the early phases of the software development process, specifically in the requirement phase. The aim of this research is to identify security threats early in the software development process to help the requirement engineer elicit appropriate security requirements in a more systematic manner throughout the requirement engineering process to ensure a secure and quality software development. This article proposes the STORE methodology for security requirement elicitation based on security threats analysis, which includes the identification of four points: PoA, PoB, PoC and PoD for effective security attack analysis. Further, the proposed STORE methodology is also validated by a case study of an ERP System. We also compare our STORE methodology with two existing techniques, namely, SQUARE and MOSRE. We have shown that more effective and efficient security requirements can be elicited by the STORE methodology and that it helps the security requirement engineer to elicit security requirements in a more organized manner.

Risk-aware decision support with constrained goal models

PurposeThe selection of security configurations for complex information systems is a cumbersome process. Decision-making regarding the choice of security countermeasures has to take into consideration a multitude of, often conflicting, functional and non-functional system goals. Therefore, a structured method to support crucial security decisions during a system’s design that can take account of risk whilst providing feedback on the optimal decisions within specific scenarios would be valuable.Design/methodology/approachSecure Tropos is a well-established security requirements engineering methodology, but it has no concepts of Risk, whilst Constrained Goal Models are an existing method to support relevant automated reasoning tasks. Hence we bridge these methods, by extending Secure Tropos to incorporate the concept of Risk, so that the elicitation and analysis of security requirements can be complimented by a systematic risk assessment process during a system’s design time and supporting the reasoning regarding the selection of optimal security configurations with respect to multiple system objectives and constraints, via constrained goal models.FindingsAs a means of conceptual evaluation, to give an idea of the applicability of the approach and to check if alterations may be desirable, a case study of its application to an e-government information system is presented. The proposed approach is able to generate security mechanism configurations for multiple optimisation scenarios that are provided, whilst there are limitations in terms of a natural trade-off of information levels of risk assessment that are required to be elicited.Originality/valueThe proposed approach adds additional value via its flexibility in permitting the consideration of different optimisation scenarios by prioritising different system goals and the automated reasoning support.

An Effective Security Requirements Engineering Framework for Cyber-Physical Systems

Context and motivation: Cyber-Physical Systems (CPSs) are gaining priority over other systems. The heterogeneity of these systems increases the importance of security. Both the developer and the requirement analyst must consider details of not only the software, but also the hardware perspective, including sensor and network security. Several models for secure software engineering processes have been proposed, but they are limited to software; therefore, to support the processes of security requirements, we need a security requirements framework for CPSs. Question/Problem: Do existing security requirements frameworks fulfil the needs of CPS security requirements? The answer is no; existing security requirements frameworks fail to accommodate security concerns outside of software boundaries. Little or even no attention has been given to sensor, hardware, network, and third party elements during security requirements engineering in different existing frameworks. Principal Ideas/results: We have proposed, applied, and assessed an incremental security requirements evolution approach, which configures the heterogeneous nature of components and their threats in order to generate a secure system. Contribution: The most significant contribution of this paper is to propose a security requirements engineering framework for CPSs that overcomes the issue of security requirements elicitation for heterogeneous CPS components. The proposed framework supports the elicitation of security requirements while considering sensor, receiver protocol, network channel issues, along with software aspects. Furthermore, the proposed CPS framework has been evaluated through a case study, and the results are shown in this paper. The results would provide great support in this research direction.

Security Requirements Elicitation from Airline Turnaround Processes

Security risk management is an important part of system development. Given that a majority of modern organizations rely heavily on information systems, security plays a big part in ensuring smooth operations of business processes. For example, many people rely on e-services offered by banks and medical establishments. Inadequate security measures in information systems have unwanted effects on an organization’s reputation and on people’s lives. This case study paper targets the secure system development problem by suggesting the application of security requirements elicitation from business processes (SREBP). This approach provides business analysts with means to elicit and introduce security requirements to business processes through the application of the security risk-oriented patterns (SRPs). These patterns help find security risk occurrences in business processes and present mitigations for these risks. At the same time, they reduce the efforts needed for risk analysis. In this paper, the authors report their experience to derive security requirements for mitigating security risks in the distributed airline turnaround systems.

Combined Assessment of Software Safety and Security Requirements

Safety is a fundamental concern in modern society, and security is a precondition for safety. Ensuring safety and security of complex integrated systems requires a coordinated approach that involve different stakeholder groups going beyond safety and security experts and system developers. The authors have therefore proposed CHASSIS (Combined Harm Assessment of Safety and Security for Information Systems), a method for collaborative determination of requirements for safe and secure systems. In this article, the authors evaluate CHASSIS through industrial case studies of two small-to-medium sized suppliers to the air-traffic management (ATM) sector. The results suggest that CHASSIS is easy to use, and that handling safety and security together provides benefits because techniques, information, and knowledge can be reused. The authors conclude that further exploration and development of CHASSIS is worthwhile, but that better documentation is needed—including more detailed process guidelines—to support elicitation of security and safety requirements and to systematically relate them to functional requirements.

System evolution through semi-automatic elicitation of security requirements: A Position Paper

Due to the security threats faced in the connected world, the consideration of security requirements during system design and modeling has become a necessity. Unfortunately, the identification of new requirements that may arise throughout additional phases of a system’s life-cycle (e.g. operation) must also be considered due to the ever-changing threat landscape. These new requirements may derive in system adaptations or modifications that ensure continuous system security. The identification of these new requirements and the implementation of their derived changes must be performed in a timely manner in order to avoid time windows where the system is vulnerable to security attacks. Unfortunately, the timely implementation of security-related changes is a challenge when dealing with automation systems as it may affect their availability and functionality. This position paper presents an approach that allows semiautomatic identification of system vulnerabilities in order to facilitate the derivation of new requirements that allow to ensure the security of a system. This identification is carried out throughout multiple phases of a system’s life-cycle.

Using the AMAN-DA method to generate security requirements: a case study in the maritime domain

Security requirements are known to be “the most difficult of requirements types” and potentially the ones causing the greatest risk if they are not correct. One approach to requirements elicitation is based on the reuse of explicit knowledge. AMAN-DA is a requirement elicitation method that reuses encapsulated knowledge in security and domain ontologies to produce security requirements specifications. The main research question addressed in this paper is to what extent is AMAN-DA able to generate domain-specific security requirements? Following a well-documented process, a case study related to the maritime domain was undertaken with the goal to demonstrate the utility and effectiveness of AMAN-DA for the elicitation and analysis of domain-specific security requirements. The usefulness of the method was also evaluated with a group of 12 experts. The paper demonstrates the elicitation of domain-specific security requirements by presenting the AMAN-DA method and its application. It describes the evaluation and reports some significant results and their implications for practice and future research, especially for the field of knowledge reuse in requirements engineering.

Identifying the implied: Findings from three differentiated replications on the use of security requirements templates

Identifying security requirements early on can lay the foundation for secure software development. Security requirements are often implied by existing functional requirements but are mostly left unspecified. The Security Discoverer (SD) process automatically identifies security implications of individual requirements sentences and suggests applicable security requirements templates. The objective of this research is to support requirements analysts in identifying security requirements by automating the suggestion of security requirements templates that are implied by existing functional requirements. We conducted a controlled experiment in a graduate-level security class at North Carolina State University (NCSU) to evaluate the SD process in eliciting implied security requirements in 2014. We have subsequently conducted three differentiated replications to evaluate the generalizability and applicability of the initial findings. The replications were conducted across three countries at the University of Trento, NCSU, and the University of Costa Rica. We evaluated the responses of the 205 total participants in terms of quality, coverage, relevance and efficiency. We also develop shared insights regarding the impact of context factors such as time, motivation and support, on the study outcomes and provide lessons learned in conducting the replications. Treatment group, using the SD process, performed significantly better than the control group (at p-value <0.05) in terms of the coverage of the identified security requirements and efficiency of the requirements elicitation process in two of the three replications, supporting the findings of the original study. Participants in the treatment group identified 84 % more security requirements in the oracle as compared to the control group on average. Overall, 80 % of the 111 participants in the treatment group were favorable towards the use of templates in identifying security requirements. Our qualitative findings indicate that participants may be able to differentiate between relevant and extraneous templates suggestions and be more inclined to fill in the templates with additional support. Security requirements templates capture the security knowledge of multiple experts and can support the security requirements elicitation process when automatically suggested, making the implied security requirements more evident. However, individual participants may still miss out on identifying a number of security requirements due to empirical constraints as well as potential limitations on knowledge and security expertise.

Effectiveness and performance analysis of model-oriented security requirements engineering to elicit security requirements: a systematic solution for developing secure software systems

Software systems are becoming more and more critical in every domain of human society. These systems are used not only by corporates and governments, but also by individuals and across networks of organizations. The wide use of software systems has resulted in the need to contain a large amount of critical information and processes, which certainly need to remain secure. As a consequence, it is important to ensure that the systems are secure by considering security requirements at the early phases of software development life cycle. In this paper, we propose to consider security requirements as functional requirements and apply model-oriented security requirements engineering framework as a systematic solution to elicit security requirements for e-governance software systems. As the result, high level of security can be achieved by more coverage of assets and threats, and identifying more traces of vulnerabilities in the early stages of requirements engineering. This in turn will help to elicit effective security requirements as countermeasures with business requirements.