The requirements tag has no wiki summary.
4
votes
3answers
150 views
Should a full disk encrypted hard drive on a live system be considered encryption at rest?
If you are specifying requirements that a certain classification of data be encrypted while at rest (on storage), should the requirement be considered met if the data is stored on an live (turned on) ...
3
votes
2answers
124 views
What are the key elements of a good security requirement?
What does a good security requirement for an application look like? I am talking about functional as well as non-functional security requirements here.
For traceability reasons I consider it ...
2
votes
2answers
139 views
Design of a state machine model to solve conflict of interest in Computer Security
I need to design a state machine model to solve conflict of interest in computer security. [I know Chinese wall model but it is an information flow model]
Are there any such existing models?
Any ...
3
votes
3answers
255 views
What to consider in an SLA to ensure secure software when outsourcing software development?
To ensure secure development in the off shore team what are considerations to be taken into account in the SLA?
I got this as a reference: ...
10
votes
6answers
304 views
Are all security requirements expected to be testable?
Many approaches exist to define security requirements. To keep it simple, i would say to define a security requirement, one need to model the threat encountered when building up misuse cases for ...
10
votes
4answers
481 views
How to define security requirements to ensure that developers… do not provide security by obscurity?
I tried to explain that security by obscurity should not be used but let's say I was challenged!
I received the answer to list the known security by obscurity that I know, as a kind of bad practice ...
1
vote
3answers
84 views
Is it necessary to protect user data if they know and agree to it being insecure?
If I'm running a website that, say, takes a survey, must I protect user data from disclosure if the users are informed initially that it's insecure? I'm not storing financial data or social security ...
