Secure Appreciative Inquiry Fuzzy Quantification Technique For Quantifying Software Security Requirements
Software developers generally focused on the core’s functions and features, but the security was only addressed as afterthought even though it was too late. The lack of proper consideration of security requirements during the early stages may lead to the development of an application with a poor sec...
Saved in:
| Summary: | Software developers generally focused on the core’s functions and features, but the security was only addressed as afterthought even though it was too late. The lack of proper consideration of security requirements during the early stages may lead to the development of an application with a poor security and the cost of correcting it might at an early stage helps to design a secure application that can withstand malicious attacks. Therefore, software and system developers need practical and systematic approaches to obtain sufficient and credible evidence of the security level in the system, which is under development in early phases of software development life-cycle (SDLC). Currently, there is limited number of reliable technique or method to quantify security requirements in software industry. Thus , the objective of the study is to construct a framework to elicit and quantify security requirements in order to ensure secure software been developed. Here, the work introduce a framework called Secure Appreciative Inquiry Fuzzy Quantification Technique (SAIFQT) which integrate Appreciative Inquiry, SQUARE, CLASP and Fuzzy Soft Set Theory techniques in eliciting and quantifying security requirements. The proposed framework, SAIFQT was evaluated with by case studies, penetration testing and validated by security experts. A mixed methodology was used in this study, a qualitative and explorative method. The results show that the proposed technique, SAIFQT was proved successfully in eliciting a new and unique software and security requirements specification. The results show the strong points in the proposed technique comparing to the normal SDLC, according to penetration testing reports, which shows three low priority alerts for the proposed technique. Meanwhile the report related to the prototype built using normal SDLC shows four high priority alerts and one for each of medium, low and informational priority security alerts. Thus , is study registered their contribution to cover security vulnerability in software intended to be build in future. |
|---|