Enhancing Security Requirements Engineering by Organizational Learning A Method Engineering Analysis

Why was it developed? Security is an important issue in software projects, Identifying security requirements is labor-intensive and error prone, New security-relevant requirements keep emerging, Security experts are a scarce resource.

Glossary Bayesian Classifiers - a family of probabilistic classifiers, based on Bayes’ theorem and the assumption of the independence of the input features. Common Criteria - international standard for the security requirements within information technology, ensuring high and consistent standards of the protection profiles of software products.

Step overview Automated analysis of the previous projects’ requirements by Heuristic Requirements Assistant (HeRA) with the application of Bayesian classifiers. Analysis of the output by the stakeholders, proposing changes to HeRA’s suggestions, as well as identifying new requirements.

Step overview Requirements elicitation by engineers on the basis of Common Criteria, as well as personal and organizational knowledge. Requirements refinement by a security expert (if available), based on his/her personal experience and best practices.

Step overview Documentation of the requirements with the use of UMLsec and storing them in the organization’s knowledge base for further reuse.

Process-Deliverable Diagram (1/2)

Process-Deliverable Diagram (2/2)

Example template

References Jürjens, J. (2001). Towards Development of Secure Systems Using UMLsec. In H. Hussmann (Ed.), Fundamental Approaches to Software Engineering (pp. 187-200). Berlin: Springer. Jürjens, J. (2002). UMLsec: Extending UML for Secure Systems Development. In J.-M. Jézéquel, H. Hussmann, S. Cook (Eds.), ≪UML≫ 2002 — The Unified Modeling Language (pp. 412-425). Berlin: Springer. Knauss, E., Luebke, D., & Meyer, S. (2009). Feedback-driven requirements engineering: the heuristic requirements assistant. In S. Fickas, J. Atlee, P. Inverardi (Eds.), Software Engineering, 2009. ICSE 2009. IEEE 31st International Conference (pp. 587-590). Vancouver, BC: IEEE. Schneider, K., Knauss, E., Houmb, S., Islam, S., & Jürjens, J. (2012). Enhancing security requirements engineering by organizational learning. Requirements Engineering, 17(1), 35-56. Vapnik, V. N., & Vapnik, V. (1998). Statistical learning theory (Vol. 1). New York: Wiley. Vetterling, M., Wimmel, G., & Wisspeintner, A. (2002). Secure systems development based on the common criteria: the PalME project. ACM SIGSOFT Software Engineering Notes, 27(6), 129-138.