Review on security requirements in the software production process

Document Type : Systematic literature review

Authors

1 Faculty of Technology and Engineering, Jahrom University, Jahrom, Iran

2 Faculty of Computer Engineering and Information Technology, Shiraz University of Technology, Shiraz, Iran

Abstract

In recent years, the issue of increasing software security has led to extensive research in the software production process. One of the main aspects of secure system engineering is identifying security requirements to protect assets. The introduction of new security implementation methods in software systems is a result of cost, time, and efficiency features related to each method for identifying security requirements. These security methods are implemented to increase confidence in systems and protect organizational assets in software production cycles. Engineers must ensure that the produced software is secure against potential threats and attacks. Identifying, classifying, prioritizing, and measuring security requirements in terms of privacy, software structure, and other factors are part of software developers' concerns. In this paper, a selection of modern security requirements methods and their security factors are collected from 2017 to 2022 and compared based on the most frequent repetition of each method's factors. This paper introduces how modern methods work for developers and leads to selecting the most appropriate methods. Moreover, it helps people who are looking for recent research in the field of security requirements.

Keywords

References

[1] شیخان م.، عباسی ع.، «راهکارهای ترکیبی نوین برای تشخیص نفوذ در شبکه‌های کامپیوتری با استفاده از الگوریتم‌های هوش محاسباتی»، مجله محاسبات نرم، جلد 6، شماره 1، ص.48-65، 1396.
[2] برنگی ح.، راجی ف.، خاصه ع.، «تحلیل تحقیقات امنیت و حریم خصوصی حوزه بلاکچین: یک مقاله علم سنجی»، مجله محاسبات نرم، جلد 9، شماره 1، ص.40-55، 1399.
[3] یداللهی ا.، سلیمی سرتختی ج.، گلی بیدگلی س.، «مدل‌سازی امنیت ماشین‌های مجازی در ابر با استفاده از تئوری بازی تکرار شونده»، مجله محاسبات نرم، جلد 10، شماره 1، ص.2-15، 1400.
[4] Villamizar H., Kalinowski M., Viana M., and Fernandez D. M., “A systematic mapping study on security in agile requirements engineering,” In 2018 44th Euromicro conference on software engineering and advanced applications (SEAA), pp. 454-461, IEEE, 2018.
[5] Hlaing S. Z. and Ochimizu k., “An Integrated Cost-Effective Security Requirement Engineering Process in SDLC Using FRAM,” In 2018 International Conference on Computational Science and Computational Intelligence (CSCI), pp. 852-857, IEEE, 2018.
[6] Behutiye W., Karhapaa P., Lopez L., Burgués X., Martinez-Fernandez S., Vollmer A.M., Rodriguez P.,  Franch X., and Oivo M., “Management of quality requirements in agile and rapid software development: A systematic mapping study,” Information and software technology, 123: 106225, 2020.
[7] Wohlin C., “Guidelines for snowballing in systematic literature studies and a replication in software engineering,” In Proceedings of the 18th international conference on evaluation and assessment in software engineering, pp. 1-10. 2014.
[8] Souag A., Mazo R., Salinesi C., and Comyn-Wattiau I., “Reusable knowledge in security requirements engineering: a systematic mapping study,” Requirements Engineering, 21(2): 251-283, 2016.
[9] Munante D., Chiprianov V., Gallon L., and Aniorté P., “A review of security requirements engineering methods with respect to risk analysis and model-driven engineering,” In International Conference on Availability, Reliability, and Security, pp. 79-93. Springer, Cham, 2014.
[10] ذاکری م.، شمسی م.، «مقایسه روش‌های مهندسی نیازمندی‌های امنیتی» دومین کنفرانس بین‌المللی مدیریت و اقتصاد در قرن 21، 1395.
[11] Mishra A. D. and Mustafa K., “A review on security requirements specification by formal methods,” Concurrency and Computation: Practice and Experience, 34(5): e6702, 2021.
[12] Mustafa N., Kamalrudin M., and Sidek S., “Security requirements template-based approach to improve the writing of complete security requirements,” Journal of Theoretical and Applied Information Technology 99(1), 2021.
[13] Wilhjelm C. and Younis A. A., “A Threat Analysis Methodology for Security Requirements Elicitation in Machine Learning Based Systems,” In 2020 IEEE 20th International Conference on Software Quality, Reliability and Security Companion (QRS-C), pp. 426-433. IEEE, 2020.
[14] Amershi S., Begel A., Bird C., DeLine R., Gall H., Kamar E., Nagappan N., Nushi B., and Zimmermann T., “Software engineering for machine learning: A case study,” In 2019 IEEE/ACM 41st International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP), pp. 291-300. IEEE, 2019. 
[15] Ishikawa F. and Yoshioka N., “How do engineers perceive difficulties in engineering of machine-learning systems?,” In 6th International Workshop on Software Engineering Research and Industrial Practice (SER&IP), pp. 2-9. IEEE, 2019. 
[16] Wan Z., Xia X., Lo D., and Murphy G. C., “How does machine learning change software development practices?,” IEEE Transactions on Software Engineering, 47(9): 1857-1871, 2021. 
[17] Mazeika D. and Butleris R., “Integrating security requirements engineering into MBSE: Profile and guidelines,” Security and Communication Networks, 2020.
[18] Hayat B., Shakoor R., Mubarak S., and Basharat K., “A goal based framework by adopting square process for privacy and security requirement engineering,” International Journal of Computer Applications, 169(11): 31-34, 2017.
[19] Li T. and Chen Z., “An ontology-based learning approach for automatically classifying security requirements,” Journal of Systems and Software, 165: 110566, 2020.
[20] Diamantopoulou V. and Mouratidis H. “Applying the physics of notation to the evaluation of a security and privacy requirements engineering methodology,” Information and Computer Security, 26(4): 382-400, 2018.
[21] Rouland Q., Hamid B., and Jaskolka J., “Specification, detection, and treatment of STRIDE threats for software components: Modeling, formal methods, and tool support,” Journal of Systems Architecture, 117: 102073, 2021.
[22] Mishra A. D. and Mustafa K., “Formalization of Security Requirements-A Case Study on a Web-Based Application,” Journal of Scientific Research, 66(2), 2022.
[23] Olukoya O., “Assessing frameworks for eliciting privacy & security requirements from laws and regulations,” Computers and Security, 117: 102697, 2022.

Files

History

  • Receive Date: 23 May 2021
  • Revise Date: 11 June 2022
  • Accept Date: 16 July 2022

Share

How to cite

Statistics