A Mandatory Access Control Policy Model for Information Security Requirements

Two basic paradigms towards speciication of information security requirements can be taken: continuous speciication and early speciication of requirements. In models supporting continuous specii-cation and reenement of information security requirements, the development organization is more vulnerable to the tampering with partially speciied requirement primitives. This paper proposes a formal model for requirement access control to prevent unauthorized modiication of security requirements, that may lead to weak or inconsistent implementation of protection measures.