Advertisement

Arabian Journal for Science and Engineering

, Volume 44, Issue 11, pp 8963–8987 | Cite as

A Systematic Review and Analytical Evaluation of Security Requirements Engineering Approaches

  • Malik Nadeem Anwar MohammadEmail author
  • Mohammed Nazir
  • Khurram Mustafa
Review Article - Computer Engineering and Computer Science
  • 239 Downloads

Abstract

Security is an inevitable concern in today’s scenario of software-based application’s pervasiveness and development practices. Researchers and practitioners frequently advocate that security-related aspects should be integrated and incorporated right from the beginning of SDLC. Security requirements engineering (SRE) plays an important role during the inceptive phases of software development. Thereby, we conducted a systematic review of the current state of the literature related to SRE. In total, we selected and analyzed 108 relevant studies. After analyzing the selected studies, we identified 20 different SRE approaches and compared them on different technical parameters like ‘performance in the requirements subphase,’ ‘usability with respect to size and complexity of the project,’ ‘notation used,’ ‘industry recognition/adoption,’ ‘tool support,’ ‘standards integration’ and ‘elicitation technique used.’ The results of this study are based on the comparative analysis of the SRE approaches, their analytical evaluation by the authors and trends observed during the course of the review. The major findings of this study indicate that SRE approaches like ‘Misuse case, Secure Tropos, SEPP and SQUARE’ are most popular among researchers while UML-based approaches like ‘Misuse Case, SecureUML and UMLsec’ are easily adaptable approaches. Threat modeling as an activity is adapted by most of the SRE approaches while few approaches support risk analysis. In addition, among several other findings, our study indicates that most of the SRE approaches fail to integrate security standards and formal methods. The contribution of this work is consequently that of supplying researchers with a summarized comparison of existing SRE approaches, along with the best practices adopted in the field of security requirements engineering. The insights provided here on selection appropriateness may prove to be instrumental for research in the area and may significantly facilitate both researchers and practitioners.

Keywords

Requirements engineering Security requirements Security requirements engineering (SRE) SRE approaches Software security Systematic review 

Notes

Acknowledgements

The authors would like to thank the Ministry of Minority Affairs, Government of India, for providing financial assistance as Junior Research Fellow (MANF-2015-17-UTT-60741) to the first author under its Maulana Azad National Fellowship (MANF) scheme.

Sources included in the Review

  1. [S1]
    Abdulrazeg, A.A.; Norwawi, N.M.; Basir, N.: Security metrics to improve Misuse case model. In: 2012 International Conference on Cyber Security, Cyber Warfare and Digital Forensic (CyberSec), pp. 94–99. IEEE (2012)Google Scholar
  2. [S2]
    Abukwaik, H.; Zhang, C.: eSQUARE: a formal methods enhanced SQUARE tool. In: Proceedings of the International Conference on Software Engineering Research and Practice (SERP), page 1. The Steering Committee of The World Congress in Computer Science, Computer Engineering and Applied Computing (WorldComp) (2012)Google Scholar
  3. [S3]
    Asnar, Y.; Giorgini, P.; Massacci, F.; Zannone, N.: From trust to dependability through risk analysis. In: The Second International Conference on Availability, Reliability and Security (ARES’07), pp. 19–26. IEEE (2007)Google Scholar
  4. [S4]
    Banerjee, C.; Banerjee, A.; Murarka, P.: Measuring software security using MACOQR (misuse and abuse case oriented quality requirement) metrics: defensive perspective. Int. J. Comput. Appl. 93(18), (2014)Google Scholar
  5. [S5]
    Banerjee, C.; Banerjee, A.; Poonia, A.S.; Sharma, S.: Proposed algorithm for identification of vulnerabilities and associated misuse cases using CVSS, CVE standards during security requirements elicitation phase. In: Soft Computing: Theories and Applications, pp. 651–658. Springer, New York (2018)Google Scholar
  6. [S6]
    Boström, G.; Wäyrynen, J.; Bodén, M.; Beznosov, K.; Kruchten, P.: Extending XP practices to support security requirements engineering. In: Proceedings of the 2006 International Workshop on Software Engineering for Secure Systems, pp. 11–18. ACM (2006)Google Scholar
  7. [S7]
    Chowdhury, M. J.M.; Matulevičius, R.; Sindre, G.; Karpati, P.: Aligning mal-activity diagrams and security risk management for security requirements definitions. In: International Working Conference on Requirements Engineering: Foundation for Software Quality, pp. 132–139. Springer, New York (2012)Google Scholar
  8. [S8]
    Cruzes, D.S.; Jaatun, M.G.; Bernsmed, K.; Tøndel, I.A.: Challenges and experiences with applying Microsoft threat modeling in Agile development projects. In: 2018 25th Australasian Software Engineering Conference (ASWEC), pp. 111–120. IEEE (2018)Google Scholar
  9. [S9]
    Dahl, H.E.I.; Stølen, K.; Hogganvik, I.: Structured semantics for the CORAS security risk modelling language. In: Pre-Proceedings of the 2nd International Workshop on Interoperability Solutions on Trust, Security, Policies and QoS for Enhanced Enterprise Systems(IS-TSPQ), Portugal, pp. 79–92. Helsingin yliopisto (2007)Google Scholar
  10. [S10]
    Den Braber, F.; Hogganvik, I.; Lund, M.S.; Stølen, K.; Vraalsen, F.: Model-based security analysis in seven steps - a guided tour to the CORAS method. BT Technol. J. 25(1), 101–117 (2007)CrossRefGoogle Scholar
  11. [S11]
    El-Attar, M.: A framework for improving quality in misuse case models. Bus. Process Manag. J. 18(2), 168–196 (2012a)CrossRefGoogle Scholar
  12. [S12]
    El-Attar, M.: Towards developing consistent misuse case models. J. Syst. Softw. 85(2), 323–339 (2012b)CrossRefGoogle Scholar
  13. [S13]
    El-Attar, M.: From misuse cases to mal-activity diagrams: bridging the gap between functional security analysis and design. Softw. Syst. Model. 13(1), 173–190 (2014)MathSciNetCrossRefGoogle Scholar
  14. [S14]
    El-Attar, M.; Luqman, H.; Karpati, P.; Sindre, G.; Opdahl, A.L.: Extending the UML statecharts notation to model security aspects. IEEE Trans. Softw. Eng. 41(7), 661–690 (2015)CrossRefGoogle Scholar
  15. [S15]
    El-Hadary, H.; El-Kassas, S.: Capturing security requirements for software systems. J. Adv. Res. 5(4), 463–472 (2014)CrossRefGoogle Scholar
  16. [S16]
    Elahi, G.; Yu, E.; Zannone, N.: A modeling ontology for integrating vulnerabilities into security requirements conceptual foundations. In: International Conference on Conceptual Modeling, pp. 99–114. Springer, New York (2009)Google Scholar
  17. [S17]
    Elahi, G.; Yu, E.; Zannone, N.: A vulnerability-centric requirements engineering framework: analyzing security attacks, countermeasures, and requirements based on vulnerabilities. Requir. Eng. 15(1), 41–62 (2010)CrossRefGoogle Scholar
  18. [S18]
    Fernandez, E.B.; Yoshioka, N.; Washizaki, H.: Modeling misuse patterns. In: Proceedings of the 4th International Conference on Availability, Reliability and Security (ARES), Fukuoka, Japan, pp. 566–571. IEEE Computer Society (2009)Google Scholar
  19. [S19]
    Firesmith, D.: Specifying reusable security requirements. J. Obj. Technol. 3(1), 61–75 (2004)CrossRefGoogle Scholar
  20. [S20]
    Fredriksen, R.; Kristiansen, M.; Gran, B.A.; Stølen, K.; Opperud, T.A.; Dimitrakos, T.: The CORAS framework for a model based risk management process. In: Proceedings of the 21st International Conference on Computer Safety, Reliabiltiy and Security, Catania, Italy, pp. 94–105. Springer, New York (2002)Google Scholar
  21. [S21]
    Giorgini, P.; Mouratidis, H.; Zannone, N.: Modelling security and trust with Secure Tropos. In: Integrating Security and Software Engineering: Advances and Future Vision, pp. 160–189. Idea Group Publishing (2006)Google Scholar
  22. [S22]
    Gregoire, J.; Buyens, K.; Win, B.D.; Scandariato, R.; Joosen, W.: On the secure software development process: CLASP and SDL compared. In: Proceedings of the 3rd International Workshop on Software Engineering for Secure Systems, Washington, DC, USA, pp. 1–7. IEEE Computer Society (2007)Google Scholar
  23. [S23]
    Gurses, S.F.; Berendt, B.; Santen, T.: Multilateral security requirements analysis for preserving privacy in ubiquitous environments. In: Proceedings of the UKDU Workshop in 17th European Conference on Machine Learning(EMCL), Berlin, Germany, pp. 51–64. Springer, New York (2006)Google Scholar
  24. [S24]
    Gurses, S.F.; Santen, T.: Contextualizing security goals: a method for multilateral security requirements elicitation. In: Proceedings of the 42nd Security Conference (SICHERHEIT), Magdeburg, Germany, pp. 42–53. LNI (2006)Google Scholar
  25. [S25]
    Haley, C.; Laney, R.; Moffett, J.; Nuseibeh, B.: Security requirements engineering: a framework for representation and analysis. IEEE Trans. Softw. Eng. 34(1), 133–153 (2008)CrossRefGoogle Scholar
  26. [S26]
    Haley, C.B.; Laney, R.C.; Moffett, J.D.; Nuseibeh, B.: Picking battles: the impact of trust assumptions on the elaboration of security requirements. In: Proceedings of the 2nd International conference on Trust Management(iTrust), Oxford, UK, pp. 347–354. Springer, New York (2004)Google Scholar
  27. [S27]
    Haley, C.B.; Laney, R.C.; Moffett, J.D.; Nuseibeh, B.: Arguing security: validating security requirements using structured argumentation. In: Proceedings of the 3rd Symposium on Requirements Engineering for Information Security (SREIS) Held in Conjunction with the 13th International Requirements Engineering Conference, Paris, France. IEEE Computer Society (2005)Google Scholar
  28. [S28]
    Haley, C.B.; Moffett, J.D.; Laney, R.; Nuseibeh, B.: A framework for security requirements engineering. In: Proceedings of the International Workshop on Software Engineering for Secure Systems(ICSE), Shanghai, China, pp. 35–42. ACM (2006)Google Scholar
  29. [S29]
    Hassan, R.; Bohner, S.; El-Kassas, S.: Formal derivation of security design specifications from security requirements. In: Proceedings of the 4th Annual Workshop on Cyber Security and Information Intelligence Research: Developing Strategies to Meet the Cyber Security and Information Intelligence Challenges Ahead, pp. 10. ACM (2008)Google Scholar
  30. [S30]
    Hatebur, D.; Heisel, M.; Jürjens, J.; Schmidt, H.: Systematic development of UMLsec design models based on security requirements. In: Proceedings of the 14th International Conference on Fundamental Approaches to Software Engineering, Saarbrucken, Germany, pp. 232–246. Springer, New York (2011)Google Scholar
  31. [S31]
    Hatebur, D.; Heisel, M.; Schmidt, H.: Security engineering using problem frames. In: Proceedings of the International Conference on Emerging Trends in Information and Communication Security (ETRICS), Freiburg, Germany, pp. 238–253. Springer, New York (2006)Google Scholar
  32. [S32]
    Hatebur, D.; Heisel, M.; Schmidt, H.: A pattern system for security requirements engineering. In: Proceedings of the 2nd International Conference on Availability, Reliability and Security(ARE), Vienna, pp. 356–365. IEEE Computer Society (2007a)Google Scholar
  33. [S33]
    Hatebur, D.; Heisel, M.; Schmidt, H.: A security engineering process based on patterns. In: Proceedings of the 18th International Workshop on Database and Expert Systems Applications(DEXA), Regensburg, Germany, pp. 734–738. IEEE Computer Society (2007b)Google Scholar
  34. [S34]
    Hatebur, D.; Heisel, M.; Schmidt, H.: Analysis and component-based realization of security requirements. In: Proceedings of the 3rd International Conference on Availability, Reliability and Security(ARES), Barcelona, Spain, pp. 195–203. IEEE Computer Society (2008)Google Scholar
  35. [S35]
    He, Q.; Antón, A.I.: A framework for modeling privacy requirements in role engineering. In: Proceedings of the 9th International Workshop on Requirements Engineering: Foundation for Software Quality (REFSQ), Klagenfurt/Velden, Austria, pp. 137–146. IEEE Computer Society (2003)Google Scholar
  36. [S36]
    Johnstone, M.N.: Modelling misuse cases as a means of capturing security requirements. In: Proceedings of the 9th Australian Information Security Management Conference, Perth, Australia, pp. 14–147. Security Research Centre, Edith Cowan University (2011)Google Scholar
  37. [S37]
    Jürjens, J.: Towards development of secure systems using UMLsec. In: Proceedings of the 4th International Conference on Fundamental Approaches to Software Engineering (FASE), London, UK. Springer, pp. 187–200 (2001)Google Scholar
  38. [S38]
    Jürjens, J.: UMLsec: Extending UML for secure systems development. In: Proceedings of the 15th International Conference on the Unified Modeling Language, Dresden, Germany, pp. 412–425. Springer, New York (2002)Google Scholar
  39. [S39]
    Jürjens, J.: Secure Systems Development with UML. Springer, New York (2005)zbMATHGoogle Scholar
  40. [S40]
    Jurjens, J.; Schreck, J.; Yu, Y.: Automated analysis of permission-based security using UMLsec. In: Proceedings of the 11th European Joint Conferences on Theory and Practice of Software(ETAPS), Budapest, Hungary, pp. 292–295. Springer, New York (2008)Google Scholar
  41. [S41]
    Jürjens, J.; Shabalin, P.: Tools for secure systems development with UML. Int. J. Softw. Tools Technol. Transf. 9(5–6), 527–544 (2007)CrossRefGoogle Scholar
  42. [S42]
    Lamsweerde, A.V.: Elaborating security requirements by construction of intentional anti-models. In: Proceedings of the 26th International Conference on Software Engineering, Washington, DC, USA, pp. 148–157. IEEE Computer Society (2004)Google Scholar
  43. [S43]
    Lamsweerde, A.V.: Engineering requirements for system reliability and security. NATO Secur. Through Sci. Ser. D-Inf. Commun. Secur. 9(1), 196 (2007)zbMATHGoogle Scholar
  44. [S44]
    Larionovs, A.; Teilans, A.; Grabusts, P.: CORAS for threat and risk modeling in social networks. Procedia Comput. Sci. 43, 26–32 (2015)CrossRefGoogle Scholar
  45. [S45]
    Lee, J.; Woo, J.; Lee, C.; Joo, K.: A software development methodology for secure web application. Int. J. Adv. Sci. Eng. Inf. Technol. 9(1), 336–341 (2019)CrossRefGoogle Scholar
  46. [S46]
    Lin, L.; Nuseibeh, B.; Ince, D.; Jackson, M.: Using abuse frames to bound the scope of security problems. In: Proceedings of the 12th IEEE International Requirements Engineering Conference, Kyoto, Japan, pp. 354–355. IEEE Computer Society (2004)Google Scholar
  47. [S47]
    Lin, L.; Nuseibeh, B.; Ince, D.; Jackson, M.; Moffett, J.: Analysing security threats and vulnerabilities using abuse frames. In: Proceedings of the 6th European Joint Conferences on Theory and Practice of Software (ETAPS), Warsaw, Poland, pp. 1–18. Springer, New York (2003a)Google Scholar
  48. [S48]
    Lin, L.; Nuseibeh, B.; Ince, D.; Jackson, M.; Moffett, J.: Introducing abuse frames for analysing security requirements. In: Proceedings of the 11th IEEE International Conference on Requirements Engineering, Los Alamitos, CA, USA, pp. 371–372. IEEE Computer Society (2003b)Google Scholar
  49. [S49]
    Liu, L.; Yu, E.; Jabeen, G.: Social threats modelling with i*. In: iStar, pp. 97–102 (2016)Google Scholar
  50. [S50]
    Liu, L.; Yu, E.; Mylopoulos, J.: Security and privacy requirements analysis within a social setting. In: Proceedings of the 11th IEEE International Conference on Requirements Engineering, Washington, DC, USA, pp. 151–162. IEEE Computer Society (2003)Google Scholar
  51. [S51]
    Lodderstedt, T.; David, B.; Doser, J.: SecureUML: A UML-based modeling language for model-driven security. In: Proceedings of the 5th International Conference on Model Driven Engineering Languages and Systems, Dresden, Germany, pp. 426–441. Springer, New York (2002)Google Scholar
  52. [S52]
    Lund, M.S.; Solhaug, B.; Stølen, K.: Risk Analysis of Changing and Evolving Systems Using CORAS. Springer, New York (2011)zbMATHCrossRefGoogle Scholar
  53. [S53]
    Maher, Z.A.; Shah, A.; Shaikh, H.; Rahu, G.A.; Butt, P.K.; Chandio, S.; Shaikh, S.: A methodology for modeling and analysis of secure systems using security patterns and mitigation use cases. In: 7th International Conference on Computer and Communication Engineering (ICCCE), pp. 268–273. IEEE (2018)Google Scholar
  54. [S54]
    Mai, P.X.; Goknil, A.; Shar, L.K.; Pastore, F.; Briand, L.C.; Shaame, S.: Modeling security and privacy requirements: a use case-driven approach. Inf. Softw. Technol. 100, 165–182 (2018)CrossRefGoogle Scholar
  55. [S55]
    Massacci, F.; Mylopoulos, J.; Paci, F.; Tun, T.T.; Yu, Y.: An extended ontology for security requirements. In: International Conference on Advanced Information Systems Engineering, pp. 622–636. Springer, New York (2011)Google Scholar
  56. [S56]
    Matulevičius, R.: Security risk-aware Secure Tropos. In: Fundamentals of Secure System Modelling, pp. 77–91. Springer, New York (2017)Google Scholar
  57. [S57]
    Matulevičius, R.; Dumas, M.: A comparison of SecureUML and UMLsec for role-based access control. In: Proceedings of the 14th East European Conference on Databases and Information Systems, Novisad, Serbia, pp. 171–185. Springer, New York (2010)Google Scholar
  58. [S58]
    Matulevicius, R.; Dumas, M.: Towards model transformation between SecureUML and UMLsec for role-based access control. In: DB&IS, pp. 339–352 (2010)Google Scholar
  59. [S59]
    Matulevičius, R.; Mayer, N.; Mouratidis, H.; Dubois, E.; Heymans, P.; Genon, N.: Adapting Secure Tropos for security risk management in the early phases of information systems development. In: Proceedings of the 20th International Conference on Advanced Information Systems Engineering (CAiSE), Montpellier, France, pp. 541–555. Springer, New York (2008)Google Scholar
  60. [S60]
    Matulevicius, R.; Mouratidis, H.; Mayer, N.; Dubois, E.; Heymans, P.: Syntactic and semantic extensions to Secure Tropos to support security risk management. J. UCS 18(6), 816–844 (2012)Google Scholar
  61. [S61]
    Mayer, N.; Dubois, E.; Matulevicius, R.; Heymans, P.: Towards a measurement framework for security risk management. In: Proceedings of Modeling Security Workshop (2008)Google Scholar
  62. [S62]
    Mayer, N.; Heymans, P.; Matulevicius, R.: Design of a modelling language for information system security risk management. In: RCIS, pp. 121–132 (2007)Google Scholar
  63. [S63]
    Mead, N.R.: How to compare the security quality requirements engineering (SQUARE) method with other methods. Technical report, Software Engineering Institute, Carnegie Mellon University (2007)Google Scholar
  64. [S64]
    Mead, N.R.: Measuring the software security requirements engineering process. In: 36th Annual IEEE Computer Software and Applications Conference Workshops (COMPSACW), pp. 583–588. IEEE (2012)Google Scholar
  65. [S65]
    Mead, N.R.; Abu-Nimeh, S.: Security and privacy requirements engineering. In: Cyber Law, Privacy, and Security: Concepts, Methodologies, Tools, and Applications, pp. 1711–1729. IGI Global (2019)Google Scholar
  66. [S66]
    Mead, N.R.; Miyazaki, S.; Zhan, J.: Integrating privacy requirements considerations into a security requirements engineering method and tool. Int. J. Inf. Priv. Secur. Integr. 1(1), 106–126 (2011)Google Scholar
  67. [S67]
    Mead, N.R.; Stehney, T.: Security quality requirements engineering (SQUARE) methodology. In: Proceedings of the Workshop on Software Engineering for Secure Systems Building Trustworthy Applications, St. Louis, Missouri, pp. 1–7. ACM (2005)Google Scholar
  68. [S68]
    Mead, N.R.; Viswanathan, V.; Padmanabhan, D.; Raveendran, A.: Incorporating security quality requirements engineering (SQUARE) into standard life-cycle models. Technical report, Software Engineering Institute, Carnegie Mellon University (2008)Google Scholar
  69. [S69]
    Mellado, D.; Fernández-Medina, E.; Piattini, M.: Applying a security requirements engineering process. In: European Symposium on Research in Computer Security, pp. 192–206. Springer, New York (2006)Google Scholar
  70. [S70]
    Mellado, D.; Fernández-Medina, E.; Piattini, M.: A common criteria based security requirements engineering process for the development of secure information systems. Comput. Stand. Interfaces 29(2), 244–253 (2007)CrossRefGoogle Scholar
  71. [S71]
    Mellado, D.; Mouratidis, H.; Fernández-Medina, E.: Secure Tropos framework for software product lines requirements engineering. Comput. Stand. Interfaces 36(4), 711–722 (2014)CrossRefGoogle Scholar
  72. [S72]
    Mouratidis, H.; Giorgini, P.: Secure Tropos: a security-oriented extension of the tropos methodology. Int. J. Softw. Eng. Knowl. Eng. 17(02), 285–309 (2007)CrossRefGoogle Scholar
  73. [S73]
    Mouratidis, H.; Giorgini, P.: Enhancing secure tropos to effectively deal with security requirements in the development of multiagent systems. Saf. Secur. Multiagent Syst. 4324(1), 8–26 (2009)CrossRefGoogle Scholar
  74. [S74]
    Oueslati, H.; Rahman, M.M.; ben Othmane, L.: Literature review of the challenges of developing secure software using the Agile approach. In: Proceedings of the 10th International Conference on Availability, Reliability and Security(ARES), Toulouse, France, pp. 540–547. IEEE Computer Society (2015)Google Scholar
  75. [S75]
    Pavlidis, M.; Islam, S.: SecTro: A CASE tool for modelling security in requirements engineering using Secure Tropos. In: CAiSE Forum, pp. 89–96 (2011)Google Scholar
  76. [S76]
    Pavlidis, M.; Mouratidis, H.; Panaousis, E.; Argyropoulos, N.: Selecting security mechanisms in Secure Tropos. In: International Conference on Trust and Privacy in Digital Business, pp. 99–114. Springer, New York (2017)Google Scholar
  77. [S77]
    Peeters, J.: Agile security requirements engineering. In: Proceedings of the Symposium on Requirements Engineering for Information Security, pp. 1–4. IEEE Computer Society, Paris, France (2005)Google Scholar
  78. [S78]
    Poonia, A.S.; Banerjee, C.; Banerjee, A.; Sharma, S.: Aligning misuse case oriented quality requirements metrics with machine learning approach. In: Soft Computing: Theories and Applications, pp. 687–692. Springer, New York (2019)Google Scholar
  79. [S79]
    Rees, J.; Bandyopadhayay, S.; Spafford, E.H.: PFIRES: a policy framework for information security. Commun. ACM 46(7), 101–106 (2003)CrossRefGoogle Scholar
  80. [S80]
    Rehman, S.; Gruhn, V.: An effective security requirements engineering framework for cyber-physical systems. Technologies 6(3), 65 (2018)CrossRefGoogle Scholar
  81. [S81]
    Riaz, M.; Stallings, J.; Singh, M.P.; Slankas, J.; Williams, L.: DIGS: a framework for discovering goals for security requirements engineering. In: Proceedings of the 10th ACM/IEEE International Symposium on Empirical Software Engineering and Measurement, p. 35. ACM (2016)Google Scholar
  82. [S82]
    Rrenja, A.; Matulevičius, R.: Pattern-based security requirements derivation from Secure Tropos models. In: IFIP Working Conference on The Practice of Enterprise Modeling, pp. 59–74. Springer, New York (2015)Google Scholar
  83. [S83]
    Saleh, F.; El-Attar, M.: A scientific evaluation of the misuse case diagrams visual syntax. Inf. Softw. Technol. 66, 73–96 (2015)CrossRefGoogle Scholar
  84. [S84]
    Salini, P.; Kanmani, S.: Application of model oriented security requirements engineering framework for secure e-voting. In: 2012 CSI Sixth International Conference on Software Engineering (CONSEG), pp. 1–6. IEEE (2012a)Google Scholar
  85. [S85]
    Salini, P.; Kanmani, S.: Elicitation of security requirements for e-health system by applying model oriented security requirements engineering (MOSRE) framework. In: Proceedings of the Second International Conference on Computational Science, Engineering and Information Technology, pp. 126–131. ACM (2012b)Google Scholar
  86. [S86]
    Salini, P.; Kanmani, S.: Security requirements engineering process for web applications. Procedia Eng. 38, 2799–2807 (2012c)CrossRefGoogle Scholar
  87. [S87]
    Salini, P.; Kanmani, S.: Effectiveness and performance analysis of model-oriented security requirements engineering to elicit security requirements: a systematic solution for developing secure software systems. Int. J. Inf. Secur. 15(3), 319–334 (2016)CrossRefGoogle Scholar
  88. [S88]
    Salini, P.; Kanmani, S.: Performance analysis of security requirements engineering framework by measuring the vulnerabilities. Int. Arab J. Inf. Technol. 15(3), 435–444 (2018)Google Scholar
  89. [S89]
    Salva, S.; Regainia, L.: A catalogue associating security patterns and attack steps to design secure applications. J. Comput. Secur. 1(Preprint), 1–26 (2019)Google Scholar
  90. [S90]
    Scandariato, R.; Wuyts, K.; Joosen, W.: A descriptive study of Microsoft’s threat modeling technique. Requir. Eng. 20(2), 163–180 (2015)CrossRefGoogle Scholar
  91. [S91]
    Schmidt, H.: Threat and risk-analysis during early security requirements engineering. In: Proceedings of the 5th International Conference on Availability, Reliability and Security (ARES), Krakow, Poland, pp. 188–195. IEEE Computer Society (2010)Google Scholar
  92. [S92]
    Schumacher, M.: Security Engineering with Patterns: Origins, Theoretical Models, and New Applications. Springer, New York (2001)zbMATHGoogle Scholar
  93. [S93]
    Shostack, A.: Experiences threat modeling at Microsoft. In: Proceedings of the 1st International Modeling Security Workshop(MODSEC), Lancaster, UK, pp. 1–11. Springer (2008)Google Scholar
  94. [S94]
    Sindre, G.; Firesmith, D.G.; Opdahl, A.L.: A reuse-based approach to determining security requirements. In: Proceedings of the 9th International Workshop on Requirements Engineering: Foundation for Software Quality(REFSQ), Velden, Austria, pp. 127–136. Springer, New York (2003)Google Scholar
  95. [S95]
    Sindre, G.; Opdahl, A.L.: Capturing security requirements through misuse cases. In: Proceedings of the 14th Norwegian Informatics Conference (NIK), Tromso, Norway, pp. 1–12. Academic Press, London (2001)Google Scholar
  96. [S96]
    Sindre, G.; Opdahl, A.L.: Eliciting security requirements with misuse cases. Requir. Eng. 10(1), 34–44 (2005)CrossRefGoogle Scholar
  97. [S97]
    Sindre, G.; Opdahl, A.L.: Misuse cases for identifying system dependability threats. J. Inf. Priv. Secur. 4(2), 3–22 (2008)Google Scholar
  98. [S98]
    Singhal, A.: Development of Agile security framework using a hybrid technique for requirements elicitation. In: Advances in Computing, Communication and Control, pp. 178–188. Springer, New York (2011)Google Scholar
  99. [S99]
    Sonia, A.S.; Balwani, J.: Analysing security and software requirements using multi-layered iterative model. Int. J. Comput. Sci. Inf. Technol. (IJCSIT) 5(2), 1283–1287 (2014)Google Scholar
  100. [S100]
    Soomro, I.; Ahmed, N.: Towards security risk-oriented misuse cases. In: Proceedings of the 10th International Conference on Business Process Management, Tallinn, Estonia, pp. 689–700. Springer, New York (2012)Google Scholar
  101. [S101]
    Souag, A.; Salinesi, C.; Mazo, R.; Comyn-Wattiau, I.: A security ontology for security requirements elicitation. In: International Symposium on Engineering Secure Software and Systems, pp. 157–177. Springer, New York (2015)Google Scholar
  102. [S102]
    Suleiman, H.; Svetinovic, D.: Evaluating the effectiveness of the security quality requirements engineering (SQUARE) method: a case study using smart grid advanced metering infrastructure. Requir. Eng. 18(3), 251–279 (2013)CrossRefGoogle Scholar
  103. [S103]
    Susi, A.; Perini, A.; Mylopoulos, J.; Giorgini, P.: The Tropos metamodel and its use. Informatica 29(4), 1–8 (2005)Google Scholar
  104. [S104]
    Velasco, J.L.; Valencia-García, R.; Fernández-Breis, J.T.; Toval, A.; et al.: Modelling reusable security requirements based on an ontology framework. J. Res. Pract. Inf. Technol. 41(2), 119 (2009)Google Scholar
  105. [S105]
    Viega, J.: Building security requirements with CLASP. SIGSOFT Softw. Eng. Not. 30(4), 1–7 (2005)CrossRefGoogle Scholar
  106. [S106]
    Wang, W.; Gupta, A.; Niu, N.: Mining security requirements from common vulnerabilities and exposures for Agile projects. In: 2018 IEEE 1st International Workshop on Quality Requirements in Agile Projects (QuaRAP), pp. 6–9. IEEE (2018)Google Scholar
  107. [S107]
    Williams, I.: An ontology based collaborative recommender system for security requirements elicitation. In: 2018 IEEE 26th International Requirements Engineering Conference (RE), pp. 448–453. IEEE (2018)Google Scholar
  108. [S108]
    Wirtz, R.; Heisel, M.: A systematic method to describe and identify security threats based on functional requirements. In: International Conference on Risks and Security of Internet and Systems, Vol. 11391, pp. 205–221. Springer, New York (2019)Google Scholar

Other References

  1. [1]
    Walton, J.P.: Developing an enterprise information security policy. In: Proceedings of the 30th Annual ACM SIGUCCS Conference on User Services, pp. 153–156. ACM, New York (2002)Google Scholar
  2. [2]
    Team, S.: Secunia vulnerability review 2014. Tech. rep., Secunia (2014)Google Scholar
  3. [3]
    Mellado, D.; Blanco, C.; Crespo, L.E.S.; Fernández-Medina, E.: A systematic review of security requirements engineering. Comput. Stand. Interfaces 32(4), 153–165 (2010)CrossRefGoogle Scholar
  4. [4]
    Viega, J.: Building security requirements with CLASP. In: Proceedings of the 2005 Workshop on Software Engineering for Secure Systems Building Trustworthy Applications, pp. 1–7 . ACM, New York (2005)Google Scholar
  5. [5]
    Elahi, G.: Security requirements engineering: State of the art and practice and challenges. Tech. rep., Department of Computer Science, University of Toronto (2009)Google Scholar
  6. [6]
    Torr, P.: Demystifying the threat-modeling process. IEEE Secur. Priv. 3(5), 66–70 (2005)CrossRefGoogle Scholar
  7. [7]
    Fabian, B.; Gürses, S.; Heisel, M.; Santen, T.; Schmidt, H.: A comparison of security requirements engineering methods. Requir. Eng. 15(1), 7–40 (2010)CrossRefGoogle Scholar
  8. [8]
    Hope, P.; McGraw, G.; Antón, A.I.: Misuse and abuse cases: getting past the positive. IEEE Secur. Priv. 2(3), 90–92 (2004)CrossRefGoogle Scholar
  9. [9]
    Mohammed, N.M.; Niazi, M.; Alshayeb, M.; Mahmood, S.: Exploring software security approaches in software development lifecycle: a systematic mapping study. Comput. Stand. Interfaces 50, 107–115 (2017)CrossRefGoogle Scholar
  10. [10]
    Kitchenham: Guidelines for performing systematic literature reviews in software engineering. Tech. rep., Software Engineering Group, School of Computer Science and Mathematics, Keele University, Keele, UK (2007)Google Scholar
  11. [11]
    Moffett, J.D.; Haley, C.B.; Nuseibeh, B.: Core security requirements artefacts. Tech. rep., Department of Computing, The Open University, Milton Keynes, UK (2004)Google Scholar
  12. [12]
    Nsa, T.: Common criteria for information technology security evaluation. Tech. rep., National Security Agency (2009)Google Scholar
  13. [13]
    Salini, P.; Kanmani, S.: Survey and analysis on security requirements engineering. Comput. Electr. Eng. 38(6), 1785–1797 (2012)CrossRefGoogle Scholar
  14. [14]
    Karpati, P.; Sindre, G.; Opdahl, A.L.: Characterising and analysing security requirements modelling initiatives. In: 2011 Sixth International Conference on Availability, Reliability and Security, IEEE, pp. 710–715 (2011)Google Scholar
  15. [15]
    Iankoulova, I.; Daneva, M.: Cloud computing security requirements: a systematic review. In: 2012 Sixth International Conference on Research Challenges in Information Science (RCIS), IEEE, pp. 1–7 (2012)Google Scholar
  16. [16]
    Raspotnig, C.; Opdahl, A.: Comparing risk identification techniques for safety and security requirements. J. Syst. Softw. 86(4), 1124–1151 (2013)CrossRefGoogle Scholar
  17. [17]
    Munante, D.; Chiprianov, V.; Gallon, L.; Aniorté, P.: A review of security requirements engineering methods with respect to risk analysis and model-driven engineering. In: International Conference on Availability, Reliability, and Security, pp. 79–93. Springer, New York (2014)Google Scholar
  18. [18]
    Kriaa, S.; Pietre-Cambacedes, L.; Bouissou, M.; Halgand, Y.: A survey of approaches combining safety and security for industrial control systems. Reliab. Eng. Syst. Saf. 139, 156–178 (2015)CrossRefGoogle Scholar
  19. [19]
    Silva, P.; Noël, R.; Matalonga, S.; Astudillo, H.; Gatica, D.; Marquez, G.: Software development initiatives to identify and mitigate security threats-two systematic mapping studies. CLEI Electron. J. 19(3), 5 (2016)Google Scholar
  20. [20]
    Biolchini, J.C.D.A.; Mian, P.G.; Natali, A.C.C.; Conte, T.U.; Travassos, G.H.: Scientific research ontology to support systematic review in software engineering. Adv. Eng. Inf. 21(2), 133–151 (2007)CrossRefGoogle Scholar
  21. [21]
    Allen, I.E.; Seaman, C.A.: Likert-scales and data-analyses. Tech. rep., ASQ Statistics Division (2007)Google Scholar
  22. [22]
    Lapouchnian, A.: Goal-oriented requirements engineering: an overview of the current research. Tech. rep., University of Toronto (2005)Google Scholar
  23. [23]
    Darimont, R.; Delor, E.; Massonet, P.; Lamsweerde, A.V.: GRAIL/KAOS: An environment for goal-driven requirements engineering. In: Proceedings of the 19th International Conference on Software Engineering (ICSE), ACM, Boston, USA, pp. 612–613 (1997)Google Scholar
  24. [24]
    Dardenne, A.; Lamsweerde, A.V.; Fickas, S.: Goal-directed requirements acquisition. Sci. Comput. Prog. 20(1–2), 3–50 (1993)zbMATHCrossRefGoogle Scholar
  25. [25]
    Lamsweerde, A.V.; Letier, E.; Darimont, R.: Managing conflicts in goal-driven requirements engineering. IEEE Trans. Softw. Eng. 24(11), 908–926 (1998)CrossRefGoogle Scholar
  26. [26]
    Yu, E.S.; Liu, L.: Modelling trust for system design using the i* strategic actors framework. In: Proceedings of the Workshop on Deception, Fraud, and Trust in Agent Societies Held During the Autonomous Agents Conference: Trust in Cyber-societies, Integrating the Human and Artificial Perspectives, Springer, London, UK, pp. 175–194 (2001)Google Scholar
  27. [27]
    Bresciani, P.; Perini, A.; Giorgini, P.; Giunchiglia, F.; Mylopoulos, J.: Tropos: an agent-oriented software development methodology. Auton. Agents Multi-Agent Syst. 8(3), 203–236 (2004)zbMATHCrossRefGoogle Scholar
  28. [28]
    Yu, E.S.: Modelling strategic relationships for process reengineering. PhD thesis, The University of Toronto, Canada (1995)Google Scholar
  29. [29]
    Fuxman, A.; Liu, L.; Mylopoulos, J.; Pistore, M.; Roveri, M.; Traverso, P.: Specifying and analyzing early requirements in tropos. Requir. Eng. 9(2), 132–150 (2004)CrossRefGoogle Scholar
  30. [30]
    Mouratidis, H.; Giorgini, P.: Secure Tropos: Dealing effectively with security requirements in the development of multiagent systems. In: Proceedings of the 2nd International Workshop on Safety and Security in Multi-agent Systems(SASEMAS). Springer, Utrecht (2005)Google Scholar
  31. [31]
    Team, C.: Common vulnerability scoring system v3. 0: Specification document. First org (2015)Google Scholar
  32. [32]
    Alexander, I.: Misuse cases: use cases with hostile intent. IEEE Softw. 20(1), 58–66 (2003)CrossRefGoogle Scholar
  33. [33]
    Faily, S.; Fléchais, I.: Finding and resolving security misusability with misusability cases. Requir. Eng. 21(2), 209–223 (2016)CrossRefGoogle Scholar
  34. [34]
    Mayer, N.: Model-based management of information system security risk. PhD thesis, University of Namur (2009)Google Scholar

Copyright information

© King Fahd University of Petroleum & Minerals 2019

Authors and Affiliations

  1. 1.Department of Computer ScienceJamia Millia Islamia UniversityNew DelhiIndia

Personalised recommendations