Interpreting the Objective Outcome of the Proposed Misuse Case Oriented Quality Requirements (MCOQR) Framework Metrics for Security Quantification

Abstract

A number of tools, techniques, methods, methodology, and standards are available to quantify the security aspect of software during its development and after it has been implemented. But the interpretation and analysis of the quantified security metrics thus obtained may be difficult for the software development team. Proper and comprehensive interpretation and analysis of quantified security metrics are essential to specify correct security requirements during the requirements engineering phase of SDLC which may result in more secured software. This research work shows how the proposed Misuse Case Oriented Quality Requirements (MCOQR) framework metrics may be used to provide identification, definition, interpretation, and analysis of security metrics during the requirements engineering phase of software development process. The authors also discuss the various primary outcomes that may be obtained using the proposed MCOQR framework metrics using the industry accepted standards like Common Vulnerability Scoring System (CVSS), Common Vulnerability Enumeration (CVE), and Common Weakness Enumeration (CWE). The work proposed is an extension of Misuse Case Oriented Quality Requirements (MCOQR) framework metrics and includes software application-specific database. The study also highlights the areas where future research work can be carried out to further strengthen the entire software system during the software development process.