Requirements for Secure Information Systems, 2014

The project will develop and evaluate methodology and tool support for security requirements engineering, integrated with mainstream software development methods. The main features of the contribution will be as follows: The methodology shall be lightweight, meant to be used primarily by mainstream software developers rather than by security experts - The methodology shall be integrated with popular methodologies for software development in general, so that security requirements can be considered in the normal run of development activities rather than as a separate activity on the side. Tools delivered in the project will not be developed from scratch but rather as add-ons to existing modeling and requirements management tools. This makes it more realistic to achieve industry-strength functionality and usability within a limited budget, and also ensures that tools will be applicable in a larger development context. Thorough evaluations (e.g., experiments, case studies) shall ensure that the methodology provides empirically founded advice on when and how to apply various techniques and tools.

本项目将开发并评估适配主流软件开发方法的安全需求工程（Security Requirements Engineering）方法与工具支撑体系。本项目的核心贡献特征如下：该方法需具备轻量性，主要面向主流软件开发人员而非安全专家；该方法需与通用主流软件开发方法论深度集成，使得安全需求可融入软件开发活动的常规流程，而非作为额外的独立环节。本项目研发的工具不会从零开始搭建，而是作为现有建模与需求管理工具的扩展插件，此举可在有限预算内更切实地实现工业级功能与易用性，同时确保工具可适配更广泛的软件开发场景。需通过全面的评估（如实验、案例研究），确保该方法能够提供基于实证依据的指导建议，明确各类技术与工具的适用时机与使用方式。