What is the goal of the security requirements phase, and what are its steps and pitfalls?
Identify and prioritise all applicable internal and external security requirements, then translate them into actionable technical requirements that are documented, approved and traceable.
* External and internal requirements are merged, prioritised, signed off and broken down into testable items. *
The phase builds on the classification and the market requirements, plus security standards or control baselines. The Requirements Manager is responsible.
- Elaborate external requirements: laws, standards, customer and certification demands.
- Elaborate internal requirements: company policies, baselines, lessons from the field.
- Prioritise them.
- Document and sign off.
- Break down and refine into S.M.A.R.T. technical requirements, use cases and backlog items for sprint planning.
Good practice: SMART requirements, a documented rationale for each, and field staff consulted (service technicians know how products really get attacked and misused). Pitfalls: no security expert involved, generic requirements, and no review.
Go deeper:
OWASP Application Security Verification Standard (ASVS) — a ready-made catalogue of testable security requirements