NDLI: Using security robustness analysis for early-stage validation of functional security requirements

Content Provider	Springer Nature Link
Author	El Attar, Mohamed Abdul Ghani, Hezam Akram
Copyright Year	2014
Abstract	Security is nowadays an indispensable requirement in software systems. Traditional software engineering processes focus primarily on business requirements, leaving security as an afterthought to be addressed via generic “patched-on” defensive mechanisms. This approach is insufficient, and software systems need to have security functionality engineered within in a similar fashion as ordinary business functional requirements. Functional security requirements need to be elicited, analyzed, specified and validated at the early stages of the development life cycle. If the functional security requirements were not properly validated, then there is a risk of developing a system that is insecure, deeming it unusable. Acceptance testing is an effective technique to validate requirements. However, an ad hoc approach to develop acceptance tests will suffer the omission of important tests. This paper presents a systematic approach to develop executable acceptance tests that is specifically geared for model-based secure software engineering processes. The approach utilizes early-stage artifacts, namely misuse case and domain models, and robustness diagrams. The feasibility of the proposed approach is demonstrated by applying it to a real-world system. The results show that a comprehensive set of security acceptance tests can be developed based upon misuse case models for early-stage validation of functional security requirements.
Starting Page	1
Ending Page	27
Page Count	27
File Format	PDF
ISSN	09473602
Journal	Requirements Engineering
Volume Number	21
Issue Number	1
e-ISSN	1432010X
Language	English
Publisher	Springer London
Publisher Date	2014-08-13
Publisher Place	London
Access Restriction	One Nation One Subscription (ONOS)
Subject Keyword	Misuse case model Security robustness analysis Acceptance tests Functional security requirements Software Engineering
Content Type	Text
Resource Type	Article
Subject	Information Systems Software

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

MOQARE: misuse-oriented quality requirements engineering

Eliciting security requirements with misuse cases

Early modeling and validation of timed system requirements using Timed Use Case Maps

Developing comprehensive acceptance tests from use cases and robustness diagrams

Automated classification of non-functional requirements

Interactive goal model analysis for early requirements engineering

Automating trade-off analysis of security requirements

Security requirement derivation by noun–verb analysis of use–misuse case relationships: a case study using positive train control

Validating software requirements with enactable use case descriptions

Using security robustness analysis for early-stage validation of functional security requirements

Similar Documents

MOQARE: misuse-oriented quality requirements engineering

Eliciting security requirements with misuse cases

Early modeling and validation of timed system requirements using Timed Use Case Maps

Developing comprehensive acceptance tests from use cases and robustness diagrams

Automated classification of non-functional requirements

Interactive goal model analysis for early requirements engineering

Automating trade-off analysis of security requirements

Security requirement derivation by noun–verb analysis of use–misuse case relationships: a case study using positive train control

Validating software requirements with enactable use case descriptions

Using security robustness analysis for early-stage validation of functional security requirements