In terms of the requirement phase, what do we mean by "security specification"? Does it mean categorizing the security requirements under the security characteristics (such as authentication, authorization) and describing them in detail?
Security Specification is a subtitle in a SRS(Software Requirements Specification) report.
Search "security" keyword in this sample SRS report to get better understanding:
Example specification from that document:
GIST: Security of the communication between the system and server.
SCALE: The messages should be encrypted for log-in communications, so others cannot get user-name and password from those messages.
METER: Attempts to get user-name and password through obtained messages on 1000 log-in session during testing.
MUST: 100% of the Communication Messages in the communication of a log-in session should be encrypted. Communication Messages: Defined: Every exchanged of information between client and server.