An Approach for Reviewing Security-Related Aspects in Agile Requirements Specifications of Web Applications

An Approach for Reviewing Security-Related Aspects in Agile Requirements Specifications of Web Applications. Villamizar, H., Anderlin-Neto, A., Kalinowski, M., Garcia, A., & Fernández, D. M. In Proceedings of the 27th IEEE International Requirements Engineering Conference, RE'19, Jeju Island, South Korea, September 23-27, pages 86-97, 2019. Nominated for Distinguished Paper Award at RE'19! Paper used as basis for receiving the "Second Best Brazilian Software Quality M.Sc. Dissertation Award" at SBQS 2020 - Student: Hugo Villamizar, Advisor: Marcos Kalinowski

Author version doi abstract bibtex 13 downloads

Defects in requirements specifications can have severe consequences during the software development lifecycle. Some of them result in overall project failure due to incorrect or missing quality characteristics. Security is one of those quality characteristics that need to be considered in early phases. There are several concerns that make security difficult to deal with; for instance, (1) when stakeholders discuss general requirements in (review) meetings, they are often not aware that they should also discuss security-related topics, and in the rather rare cases they are aware (2), they typically do not have sufficient security expertise. This picture is even more challenging in agile development contexts, where lightweight documentation are typically involved. To address these issues, we designed an approach that considers user stories and security specifications as input and relates those user stories to security properties via Natural Language Processing (NLP) techniques. Based on the related security properties, our approach then identifies high-level security requirements from the Open Web Application Security Project (OWASP) to be verified afterwards. In a last step, the verification of the generated security requirements is then conducted via a focused reading technique. We finally validate our approach via a controlled experiment comparing the effectiveness and efficiency of novice inspectors (we used two different groups of students) verifying security aspects in agile requirements using our generated reading techniques against using the complete list of OWASP high level security requirements and a the same list of defect types embedded in our technique. The (statistically significant) results indicate that using the reading technique has a positive impact (with large effect size) on the performance of inspectors in terms of effectiveness and efficiency.

@inproceedings{VillamizarAKGM19,
 author = {Hugo Villamizar and Amadeu Anderlin-Neto and Marcos Kalinowski and Alessandro Garcia and Daniel M{\'{e}}ndez Fern{\'{a}}ndez},
 title = {An Approach for Reviewing Security-Related Aspects in Agile Requirements Specifications of Web Applications},
 abstract = {Defects in requirements specifications can have severe consequences during the software development lifecycle. Some of them result in overall project failure due to incorrect or missing quality characteristics. Security is one of those quality characteristics that need to be considered in early phases. There are several concerns that make security difficult to deal with; for instance, (1) when stakeholders discuss general requirements in (review) meetings, they are often not aware that they should also discuss security-related topics, and in the rather rare cases they are aware (2), they typically do not have sufficient security expertise. This picture is even more challenging in agile development contexts, where lightweight documentation are typically involved. To address these issues, we designed an approach that considers user stories and security specifications as input and relates those user stories to security properties via Natural Language Processing (NLP) techniques. Based on the related security properties, our approach then identifies high-level security requirements from the Open Web Application Security Project (OWASP) to be verified afterwards. In a last step, the verification of the generated security requirements is then conducted via a focused reading technique. We finally validate our approach via a controlled experiment comparing the effectiveness and efficiency of novice inspectors (we used two different groups of students) verifying security aspects in agile requirements using our generated reading techniques against using the complete list of OWASP high level security requirements and a the same list of defect types embedded in our technique. The (statistically significant) results indicate that using the reading technique has a positive impact (with large effect size) on the performance of inspectors in terms of effectiveness and efficiency.},
 booktitle = {Proceedings of the 27th {IEEE} International Requirements Engineering Conference, {RE'19}, Jeju Island, South Korea, September 23-27},
 year = {2019},
 note = {<font color="red">Nominated for Distinguished Paper Award at RE'19! Paper used as basis for receiving the "Second Best Brazilian Software Quality M.Sc. Dissertation Award" at SBQS 2020 - Student: Hugo Villamizar, Advisor: Marcos Kalinowski</font>}, 
 pages = {86-97},
 urlAuthor_version = {http://www.inf.puc-rio.br/~kalinowski/publications/VillamizarAKGM19.pdf},
 doi = {10.1109/RE.2019.00020},
}

Downloads: 13