A systems-of-systems security framework for requirements definition in cloud environment

There are many aspects that involve the development of secure software. Regardless of the development model, the verification and validation of security must always be present, in all environments and stages. Systems-of-Systems (SoS) refer to a complex system that comprises other systems (the constituent systems), which have operational and managerial independence, geographical distribution, emergent behavior, and evolutionary development processes. By integrating cloud computing applications and services into a complex existing system, many challenges arise, especially those related to security issues. In this paper, it is proposed a security framework to guide the planning and definition phases of security requirements for SoS considering agile methods for application development and a DevSecOps approach. By using a checklist and some questions to identify which security aspects should be included, security drivers were obtained to integrate cloud computing in a SoS context, taking into account the perspectives of existing IT Governance Model, IT Operational Model, and IT Processes. Additionally, it is emphasized the need for a human resources management that aims at the positive acceptance of organizational change by all involved.