Search

The researchers have been focusing on embedding security from the early phases of software development lifecycle. They have researched and innovated a field of Security Engineering where security concerns are embedded during requirement, design, and testing phases of software development. Efforts were made in developing methods, methodologies, and tools to handle security issues. Various methods are present in the literature for eliciting, analyzing and prioritizing the security requirements. During the design phase based on prioritized requirements, environment parameters and attribute a suitable security algorithm mainly cryptography algorithms are identified. Then a question arises how to test the effectiveness of chosen algorithm? Therefore, as an answer to the issue in this paper, a process for Security Testing is presented that evaluates the selected security algorithms. Evaluation is done by generating the test scenarios for functionalities using sequence diagram representing the threats at vulnerable points. Then, checking the mitigation of potential threats at identified vulnerable points. A security index is generated which shows the effectiveness of deployed/ chosen security algorithm. The process ends with the generation of a test report depicting the testing summary. For a clear understanding of the process, the proposal is illustrated with a case study of the cloud storage as a service model.

Providing security to complex information system development is challenging because of complex network and ubiquitous system. Traditional mechanisms address security concerns during development or design phases that may lead to various loopholes or over-constrained system. The field of security engineering has emerged whereby security requirements are gathered along with other requirements during the initial phase of software development. However, dealing with security concerns during the initial phases of development is challenging because of design and code unavailability. The paper first represents the proposals for security requirements engineering based on different approaches such as use case approach, goal-oriented approach, and process-oriented approach. These methodologies are evaluated along various parameters such as security engineering activities covered, application domain and others. The in-depth analysis ends with a recent proposal for security engineering and list of unresolved issues that needs consideration. The outcome of the paper can be exploited to drive further research.