A Systematic Framework for Structured Object Oriented Security Requirements Analysis

There are several approaches to elicit, analyze and specify security requirements ranging from formal mathematical models for proof of certain security properties to informal methods which are easily understood. Applicability of formal security models is limited since they are complex and it is time consuming to develop. On the other hand, informal security requirements analysis methods are not integrated with conceptual models in requirements analysis and they provide no process for analyzing both internal and external threats in a structured manner. This paper discusses a structured object oriented security requirements analysis methodology for the elicitation and analysis of security requirements. It is capable of identifying hierarchically both external and internal threats posed by both external and internal actors of a system level by level. It is illustrated and validated by security requirements analysis for an online banking system and an advanced power grid control system.