Grupo Alarcos · Conference paper · 2006
SREP: A Proposal for Establishing Security Requirements for the Development of Secure Information Systems
Daniel Mellado Fernández, Eduardo Fernández-Medina Patón, Mario Piattini Velthuis
Nowadays, security solutions are mainly focused on providing security defences, instead of solving one of the main reasons for security problems that refers to an appropriate Information Systems (IS) design. In this paper a proposal for establishing security requirements for the development of secure IS is presented. Our approach is an asset-based and risk-driven method, which is based on the reuse of security requirements, by providing a security resources repository, together with the integration of the Common Criteria into traditional software lifecycle model, so that it conforms to ISO/IEC 15408. Starting from the concept of iterative software construction, we will propose a micro-process for the security requirements analysis, that is repeatedly performed at each level of abstraction throughout the incremental development. In brief, we will present an approach which deals with the security requirements at the first stages of software development in a systematic and intuitive way, and which conforms to ISO/IEC 17799:2005.
On the same topic
- 2006 Applying a Security Requirements Engineering Process
- 2009 Automated Support for Security Requirements Engineering in Software Product Line Domain Engineering
- 2006 A Comparative Study of Proposals for Establishing Security Requirements for the Development of Secure Informat
- 2008 Security Requirements Engineering Process for Software Product Lines: A Case Study