Questions tagged [requirements]
The requirements tag has no usage guidance.
24
questions
2
votes
1
answer
133
views
Who is responsible for a project's security requirements?
The product owner is responsible for the functional requirements, but who is responsible for the security requirements? Security requirements are thought of as nonfunctional requirements but is this ...
- 121
1
vote
1
answer
124
views
MSTG-ARCH-3 What means?
In the OWASP Mobile Application Security Checklist there is a requirement called MSTG-ARCH-3 which describes:
"A high-level architecture for the mobile app and all connected remote
services has ...
- 13
1
vote
2
answers
69
views
any security baseline reference we can use? paid or free
We are looking to provide our Devs and Ops with minimal security baseline requirements - reference materials that they should follow during coding/implementation/etc.
Maybe requirements based on NIST ...
- 11
1
vote
2
answers
138
views
How much does the strength of the password depend on the variety of characters?
For example, a password consisting only of lower-case characters [a-z], but a length of 10 (26^10), will always be better than all characters, but a length of 7 (95^7).
That is, how much is it correct ...
- 35
4
votes
2
answers
851
views
MSTG-ARCH-7: All security controls have a centralized implementation
In the OWASP Mobile Application Security Checklist there is a requirement MSTG-ARCH-7 which reads: "All security controls have a centralized implementation".
Now I'm struggling a bit by what ...
0
votes
1
answer
122
views
Information Security Governance - security measures
We are about to sign a contract with an OCR service provider (Scanned documents(personal information) will be sent, which will be processed OCR, data transmitted back and documents deleted.)The ...
0
votes
1
answer
108
views
Is this a "valid" security policy item?
I'm reading a security policy, which seems to be a system security policy and there is an item that requires the system to implement a specific standard, something like "Implement the standard XYZ". ...
- 35
0
votes
0
answers
164
views
Recognized complement to OWASP's ASVS requirements
The OWASP ASVS focuses on web-application verification. It is free and recognised worldwide as a good reference to build upon, or simply reuse. It is useful to use it when outsourcing web development.
...
- 1,619
1
vote
1
answer
267
views
VPN Access to PCI Environment Edge Devices
Does it violate PCI DSS requirements to provide a third party company with a Site-to-Site VPN connection for full management (SSH & HTTPS) access to network security equipment (such as a Web ...
- 11
-1
votes
1
answer
133
views
Security mechanisms and techniques
Should we define the security mechanisms and techniques that will be used in order to mitigate the security risks during the requirement phase or design phase
(Such as deciding to use the S/MIME ...
- 529
0
votes
1
answer
998
views
Security specification
In terms of the requirement phase, what do we mean by "security specification"? Does it mean categorizing the security requirements under the security characteristics (such as authentication, ...
- 529
5
votes
2
answers
1k
views
Bug bar in the Microsoft SDLC
The Microsoft SDLC model decomposed the requirement phase into different practices, one of which is creating quality gates/ bug bar, where each identified bug should be classified into client or ...
- 529
4
votes
2
answers
433
views
Connection between "Security Requirements Engineering", "Risk Analysis" and "Threat Modeling"
I am trying to figure out how the above concepts fit in together.
As i understood it Security Requirements Engineering (SRE), Risk Analysis (RA) and Threat Modeling (TM) are methods that ultimately ...
- 281
1
vote
0
answers
150
views
what security features a good Email Service Provider (for marketing) should have?
To choose the right Email Service Provider (ESP) for e-mail marketing processes, what are security requirements and checklists that we should pay attention to and ask for from vendors?
In other ...
- 915
7
votes
4
answers
6k
views
What is the difference between misuse and abuse cases in security?
I know that misuse cases are use cases which help identify security requirements as they highlight the user's goal in misusing the system, but what exactly is abuse cases and what is the difference or ...
- 173
5
votes
5
answers
1k
views
Outsourcing software development and its effect on security
Some companies build their own software. Others outsource software development by hiring contractors or other companies to build software they need.
When we need to build new custom software, is ...
- 99.3k
0
votes
3
answers
210
views
Does semi-sensitive information demand encryption / security? [closed]
Since it's been requested that this question be rewritten:
Is SSL (or some other encryption equivalent) required in the below case? From a small local business website, is there any damage that an ...
- 151
14
votes
5
answers
3k
views
Should a full disk encrypted hard drive on a live system be considered encryption at rest?
If you are specifying requirements that a certain classification of data be encrypted while at rest (on storage), should the requirement be considered met if the data is stored on an live (turned on) ...
- 9,721
4
votes
2
answers
825
views
What are the key elements of a good security requirement?
What does a good security requirement for an application look like? I am talking about functional as well as non-functional security requirements here.
For traceability reasons I consider it ...
- 7,399
2
votes
2
answers
303
views
Design of a state machine model to solve conflict of interest in Computer Security
I need to design a state machine model to solve conflict of interest in computer security. [I know Chinese wall model but it is an information flow model]
Are there any such existing models?
Any ...
- 23
5
votes
3
answers
659
views
What to consider in an SLA to ensure secure software when outsourcing software development?
To ensure secure development in the off shore team what are considerations to be taken into account in the SLA?
I got this as a reference: http://www.it-director.com/enterprise/technology/content.php?...
- 922
10
votes
6
answers
2k
views
Are all security requirements expected to be testable?
Many approaches exist to define security requirements. To keep it simple, i would say to define a security requirement, one need to model the threat encountered when building up misuse cases for ...
- 2,237
10
votes
4
answers
2k
views
How to define security requirements to ensure that developers... do not provide security by obscurity?
I tried to explain that security by obscurity should not be used but let's say I was challenged!
I received the answer to list the known security by obscurity that I know, as a kind of bad practice ...
- 2,237
4
votes
3
answers
179
views
Is it necessary to protect user data if they know and agree to it being insecure?
If I'm running a website that, say, takes a survey, must I protect user data from disclosure if the users are informed initially that it's insecure? I'm not storing financial data or social security ...
- 1,851