Requirements Engineering

, Volume 21, Issue 4, pp 481–504

Automating trade-off analysis of security requirements

  • Liliana Pasquale
  • Paola Spoletini
  • Mazeiar Salehie
  • Luca Cavallaro
  • Bashar Nuseibeh
Original Article

DOI: 10.1007/s00766-015-0229-z

Cite this article as:
Pasquale, L., Spoletini, P., Salehie, M. et al. Requirements Eng (2016) 21: 481. doi:10.1007/s00766-015-0229-z
  • 414 Downloads

Abstract

A key aspect of engineering secure systems is identifying adequate security requirements to protect critical assets from harm. However, security requirements may compete with other requirements such as cost and usability. For this reason, they may only be satisfied partially and must be traded off against other requirements to achieve “good-enough security”. This paper proposes a novel approach to automate security requirements analysis in order to determine maximum achievable satisfaction level for security requirements and identify trade-offs between security and other requirements. We also propose a pruning algorithm to reduce the search space size in the analysis. We represent security concerns and requirements using asset, threat, and goal models, initially proposed in our previous work. To deal with uncertainty and partial requirements, satisfaction security concerns are quantified by leveraging the notion of composite indicators, which are computed through metric functions based on range normalisation. An SMT solver (Z3) interprets the models and automates the execution of our analyses. We illustrate and evaluate our approach by applying it to a substantive example of a service-based application for exchanging emails.

Keywords

Security requirements Trade-off analysis Goals 

Funding information

Funder NameGrant NumberFunding Note
European Research Council
  • 291652
Science Foundation Ireland
  • 10/CE/I1855
  • 13/RC/2094

Copyright information

© Springer-Verlag London 2015

Authors and Affiliations

  • Liliana Pasquale
    • 1
  • Paola Spoletini
    • 2
  • Mazeiar Salehie
    • 1
  • Luca Cavallaro
    • 1
  • Bashar Nuseibeh
    • 1
    • 3
  1. 1.Lero - the Irish Software Engineering Research CentreUniversity of LimerickLimerickIreland
  2. 2.Department of Software Engineering and Game DevelopmentKennesaw State UniversityMariettaUSA
  3. 3.Department of ComputingThe Open UniversityMilton KeynesUK

Personalised recommendations