Holistic security requirement engineering for electronic commerce

With the introduction of electronic commerce, business is becoming dependent on information systems in a new way. Information security is thus becoming more and more important to companies' self-protection. In contrast to previous systems, this is also directly visible to the customer. The changing situation means, however, that the requirements for security cannot be solely filled by new policies and risk analysis. This article proposes an approach called ''holistic security requirement engineering'' meant to elicit security requirements according to system-theoretic considerations. It will show that security requirements can be defined with the help of investigations in the business environment, workshops with stakeholders and risk analysis. This multidimensional approach will lead to a holistic understanding of the requirements that fit into the system development life cycles.

[1]  Eugene Tucker,et al.  Risk Analysis and the Security Survey , 1999 .

[2]  Henry M. Franken,et al.  Information security embedded in the design of telematics systems , 1997, Comput. Secur..

[3]  Jim Goldman,et al.  Metrics based security assessment (MBSA): combining the ISO 17799 standard with the systems security engineering capability maturity model (SSE-CMM) , 2004 .

[4]  F. Schneider.  Trust in Cyberspace , 1998 .

[5]  Louise Yngström,et al.  A systemic-holistic approach to academic programmes in IT security , 1996 .

[6]  Ian K. Bray,et al.  An Introduction to Requirements Engineering , 2002 .

[7]  Dean Leffingwell,et al.  Managing software requirements: a unified approach , 1999 .

[8]  Albin Zuccato,et al.  Towards a systemic holistic security management , 2002 .

[9]  Luo Huai,et al.  System Security Engineering Capability Maturity Model , 2003 .

[10]  Stephanie Teufel,et al.  The use of business process models for security design in organisations , 1996, SEC.

[11]  Suzanne Robertson,et al.  Mastering the Requirements Process , 1999 .

[12]  M. Hammer,et al.  REENGINEERING THE CORPORATION: A MANIFESTO FOR BUSINESS REVOLUTION , 1995 .

[13]  Sebastiaan H. von Solms,et al.  A technique to include computer security, safety, and resilience requirements as part of the requirements specification , 1995, J. Syst. Softw..

[14]  Evangelos A. Kiountouzis,et al.  The use of business process modelling in information systems security analysis and design , 2000, Inf. Manag. Comput. Secur..

[15]  Shari Lawrence Pfleeger,et al.  A framework for security requirements , 1991, Comput. Secur..

[16]  Rossouw von Solms,et al.  From Risk Analysis to Security Requirements , 2001, Comput. Secur..

[17]  Thomas Peltier,et al.  Information Technology: Code of Practice for Information Security Management , 2001 .

[18]  R. Winter,et al.  Business Engineering: Auf dem Weg zum Unternehmen des Informationszeitalters , 2000 .

[19]  John P. McDermott,et al.  Using abuse case models for security requirements analysis , 1999, Proceedings 15th Annual Computer Security Applications Conference (ACSAC'99).

[20]  Ivar Jacobson,et al.  The Unified Software Development Process , 1999 .

[21]  Sebastiaan H. von Solms,et al.  Information Security - A Multidimensional Discipline , 2001, Comput. Secur..