Security quality requirements engineering (SQUARE) methodology

By N. Mead, Ted Stehney. SESS@ICSE, 2005

456 citations recorded by the source corpus.

Requirements engineering, a vital component in successful project development, often neglects sufficient attention to security concerns. Further, industry lacks a useful model for incorporating security requirements into project development. Studies show that upfront attention to security saves the economy billions of dollars. Industry is thus in need of a model to examine security and quality requirements in the development stages of the production lifecycle.In this paper, we examine a methodology for both eliciting and prioritizing security requirements on a development project within an organization. We present a model developed by the Software Engineering Institute's Networked Systems Survivability (NSS) Program, and then examine two case studies where the model was applied to a client system. The NSS Program continues to develop this useful model, which has proven effective in helping an organization understand its security posture.

Subfields: Information Systems

View Paper: https://www.semanticscholar.org/paper/fe6402f1a3c039d607de3899b747cd0b4324673c

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

Citations in the corpus

DAG-based attack and defense modeling: Don't miss the forest for the attack trees (2013, methodology): “Attack trees may occur in the SQUARE methodology [168].”
Security Requirements Engineering: A Framework for Representation and Analysis (2008, methodology): “Adequate general requirements have been shown to have a very positive impact on the acceptance of a project’s deliverable: For examples see the Standish Group’s Chaos reports [72], [73], [74], and the introduction to [55].”