Many approaches exist to define security requirements. To keep it simple, i would say to define a security requirement, one need to model the threat encountered when building up misuse cases for specific use cases being worked out. Still, at the end, some security requirements are at architectural level while others are at code level.
Most of what I can think of as security requirements at any of these levels seem to have test cases (whether automated or not). Still, in some examples: like the need to stop an intentional back door, for me, it is worth being formulated in a security requirement.
- I can't think of a test case for it though! intentional is pretty difficult to proof using a test case! Thus my question: isn't this worth being a security requirement?
- and now to the generalized version of the question: Would not having a test case for a security requirement be considered to be an indicator that I have an improper security requirement?