Question
What are the main topics covered in Security Requirements Engineering and how do they relate to each other?
Answer
Seven building blocks that flow into each other: Requirements → Diagraming → SDLC → Threat Modelling → STRIDE → DREAD → Use/Misuse Cases — a pipeline from "what to build" to "what could go wrong and how badly."
Topic Overview:
| Topic | Purpose |
|---|---|
| Requirements | Define what the system should do (Functional/Non-Functional) |
| Diagraming | Document requirements in a universally understandable way |
| SDLC | Framework for secure software development lifecycle |
| Threat Modelling | Record and analyze threats using tools |
| STRIDE | Identify and enumerate threats |
| DREAD | Rate and prioritize risks |
| UCS/MUCS | Document desired behavior and security threats |
Key Insight: A comprehensive, risk-based approach is very targeted and desirable because it conserves resources.
Note saved — thanks!
Question
What are the three main sources for eliciting requirements?
Answer
Stakeholders (interviews, workshops), Documents (existing docs, regulations), and Systems (existing systems and their interfaces).
Requirement Elicitation Process:
- Stakeholder Analysis - Get to know all involved parties
- Requirement Sources:
- Stakeholders (interviews, workshops)
- Documents (existing documentation, regulations)
- Systems (existing systems, interfaces)
Requirement Types:
| Type | Description | Example |
|---|---|---|
| Functional | What the system should do | Login functionality |
| Quality/Non-functional | Quality concerns not covered by functional requirements | Secure storage of log data |
| General regulations/conditions | External constraints | PCI-DSS compliance, go-live deadline |
Note saved — thanks!