Argumentation-based security requirements elicitation: The next round

摘要: Information Security Risk Assessment can be viewed as part of requirements engineering because it is used to translate security goals into requirements, where are the desired system properties that mitigate threats goals. To improve defensibility these mitigations, several researchers have attempted base risk assessment on argumentation structures. However, none approaches so far been scalable or usable in real-world assessments. In this paper, we present results from our search for a argumentation-based information RA method. We start previous work both formal frameworks and informal argument structuring try find promising middle ground. An initial prototype using spreadsheets validated iteratively improved via Case Studies. Challenges such scalability, quantify-ability, ease use, relation existing parallel fields discussed. Finally, explore scope applicability approach with regard various classes Systems while also drawing more general conclusions role security.