Q
Problem solve Get help with specific problems with your technologies, process and projects.

How to gather security requirements for software projects and what to look for

There are a many things to focus on when defining security requirements for any software development effort. But the most prominent should be long term ones like input validation, URL manipulation and logic.

What is the best way of gathering security requirements? Are there examples of standard security requirements for different types of applications (ie. Web applications?)
The best way to gather security requirements is to think big and think long term. What is it you're trying to accomplish with the application you're building? How will security add value to the overall problem that's addressed by the application? Will the necessary controls for today serve the application well down the road? Determine the specific business goals first and then you can drill down from there and determine specific security requirements.

When looking at the details, you'll need to consider authentication, access controls, encryption, audit logging,...

and minimum configuration requirements for the underlying server OS, Web server, middleware, and database system. You'll also want to drill down further and address common vulnerabilities related to input validation, URL manipulation, privilege escalation, application logic and so on.

Focus not only on best practices but also on how security can be used as an enabler or provide a competitive advantage to your business. Also, don't overlook the importance of documenting any known limitations the security controls you're building in have - they will exist. List the weaknesses, tradeoffs and any other compensating controls that can be used to keep things in check.

Finally, be careful using other people's requirements. Simply downloading security requirements templates off the Internet is akin to downloading security policy documents and assuming - better yet, hoping - they'll work in your business' best interests. It's OK to get rolling with some general guidelines but only you and your team will know what's best for your business given your own unique situation.

This was last published in July 2010

Dig Deeper on Software Quality Resources

PRO+

Content

Find more PRO+ content and other member only offers, here.

Have a question for an expert?

Please add a title for your question

Get answers from a TechTarget expert on whatever's puzzling you.

You will be able to add details on the next page.

Start the conversation

Send me notifications when other members comment.

By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Please create a username to comment.

-ADS BY GOOGLE

SearchMicroservices

TheServerSide.com

SearchCloudApplications

SearchAWS

SearchBusinessAnalytics

SearchFinancialApplications

SearchHealthIT

DevOpsAgenda

Close