Security Requirements Assurance: An Assurance Case Perspective

• Main Authors: Janisar, A.A., Kalid, K.S.B., Sarlan, A.B., Gilal, A.R.
• Format: Conference or Workshop Item
• Published: Institute of Electrical and Electronics Engineers Inc. 2023
• Online Access: http://scholars.utp.edu.my/id/eprint/38021/; https://www.scopus.com/inward/record.uri?eid=2-s2.0-85175471070&doi=10.1109%2fICSECS58457.2023.10256374&partnerID=40&md5=742a6bf6b06f75db6b2e11ab9ade67eb

In the current era, software security requirements domain has changed thoroughly, and has been considered an essential aspect for software quality. Machine learning and artificial intelligence have become the emerging trends to automate the identification and specification of security requirements. As an active research area, security requirements specifications are recognized and persuaded in software engineering and security assurance communities. Overfitting of security requirements after system design can result in security issues in current system architecture. Consistency, completeness, and correctness are critical requirements for ensuring the effectiveness of systems architecture. However, without these security requirements, the system is vulnerable to attacks and organization's assets, and its reputation is at risk. Moreover, it increases the cost and time to fix the security problem. Therefore, to avoid such problems security requirements need to be identified more precisely and consistently. Realizing the benefits of assurance case, A conceptual framework is proposed for identification of security requirements correctness, consistency and completeness using assurance case. Objective of the proposed conceptual framework to assist the security requirement engineer to identify the security requirements using assurance case during requirement phase i.e., the security requirements are correct, complete, and consistent. The proposed conceptual framework involves five phases: (1) assets identification, (2) threat identification, (3) security objectives, (4) security requirements identification and (5) security requirement assessment. © 2023 IEEE.