Towards a New Quantitative Availability Model for Computer Systems Based on Classifications of Security Requirements

2. Security Requirements Classifications

Security (Caldern and Marta, 2007) is currently a major concern for software engineers. Much attention has been paid to security vulnerabilities introduced during the design or coding phases of the software development lifecycle. However, there is a need to use more security guides in the requirements engineering phase. Although security vulnerabilities are rarely introduced in requirements specifications, it is highly recommended to consider security requirements early in the software development process, to avoid introducing vulnerabilities during this development phase. Security requirements can be expressed as security constraints on functional requirements.

However, most of the time security requirements are defined by describing the mechanism used to implement the security (e.g. the system must provide an authentication mechanism), but the security issue that the requirement is supposed to resolve is unclear and the security requirements are not linked to the functional requirements.