A Novel Approach for Acquiring Training and Software Security Requirements

ABSTRACT

Security is an important software quality attribute albeit, as a nonfunctional requirement, often overlooked. Although several approaches for security requirements engineering exist, it is not clear how to adapt security requirements to software end users. This poster aims to fill in this gap by developing a novel approach for acquiring security requirements by leveraging end user analysis and a security body of knowledge. To achieve this aim, we divide security requirements into two categories. Software security requirements are those that need to be technically implemented in the developed software. Training security requirements are those that aim to provide the necessary training to the end users that need it. The proposed approach may help security experts in security requirements engineering tailored to the characteristics of end users.

References

1. RJ Macasaet, Manuel Noguera, Maria Luisa Rodríguez, José Luis Garrido, Sam Supakkul, and Lawrence Chung. 2019. Micro-business Requirements Patterns in Practice: Remote Communities in Developing Nations. Journal of Universal Computer Science 25, 7 (2019), 764--787. https://doi.org/10.3217/jucs-025-07-0764
2. Anže Mihelič, Matej Jevšček, Simon Vrhovec, and Igor Bernik. 2019. Testing the human backdoor: Organizational response to a phishing campaign. Journal of Universal Computer Science 25, 11 (2019), 1148--1477. https://doi.org/10.3217/jucs-025-11-1458
3. Deepti Mishra and Samia Abdalhamid. 2019. Software Quality Issues in SCRUM: A Systematic Mapping. Journal of Universal Computer Science 24, 12 (2019), 1690--1716. https://doi.org/10.3217/jucs-024-12-1690
4. Mahmood Niazi, Ashraf Mohammed Saeed, Mohammad Alshayeb, Sajjad Mahmood, and Saad Zafar. 2020. A maturity model for secure requirements engineering. Computers and Security 95 (2020), 101852. https://doi.org/10.1016/j.cose.2020.101852
5. Kathryn Parsons, Agata McCormac, Marcus Butavicius, Malcolm Pattinson, and Cate Jerram. 2014. Determining employee awareness using the Human Aspects of Information Security Questionnaire (HAIS-Q). Computers and Security 42 (2014), 165--176. https://doi.org/10.1016/j.cose.2013.12.003
6. Ismini Vasileiou and Steven Furnell. 2019. Personalising Security Education: Factors Influencing Individual Awareness and AC. In Information Systems Security and Privacy: 4th International Conference, ICISSP 2018. Springer, Funchal, Madeira, Portugal, 315--321.
7. Zhengshu Zhou, Qiang Zhi, Shuji Morisaki, and Shuichiro Yamamoto. 2020. An Evaluation of Quantitative Non-Functional Requirements Assurance Using Archi-Mate. IEEE Access 8 (2020), 72395--72410. https://doi.org/10.1109/ACCESS.2020.2987964

Index Terms

• Security and privacy

  • Formal methods and theory of security

    • Security requirements