Software Engineering for Security as a Non-functional Requirement

Abstract

Interactions between software engineering and security requirements or engineering can be carried out in almost all software process phases, i.e. requirements analysis, design, implementation, verification, and deployment. In current information era, modern societies and emergent business increasingly rely on technology and communication. It becomes inevitable that every software system developed today must defend itself from malicious adversaries. Organizations used to adhere to well-defined and proved models for software development, but these models were originally proposed for functional requirements. The non-functional requirements don’t receive the same level of concern. Non-functional requirements address how the system should behave. It is understood that adding non-functional requirements after the system (functional) requirements and design are done is both difficult, expensive, and sometimes impossible. This paper comprehensively studies how security as a non-functional requirement is incorporated in the software development life-cycle. It shows how to unify the security policies with the development models earlier in development life cycle. The work accommodate any non-functional requirement but the case study is centred on security.