A Practical Approach to Stakeholder-driven Determination of Security Requirements based on the GDPR and Common Criteria
- We propose and apply a requirements engineering approach that focuses on security and privacy properties and takes into account various stakeholder interests. The proposed methodology facilitates the integration of security and privacy by design into the requirements engineering process. Thus, specific, detailed security and privacy requirements can be implemented from the very beginning of a software project. The method is applied to an exemplary application scenario in the logistics industry. The approach includes the application of threat and risk rating methodologies, a technique to derive technical requirements from legal texts, as well as a matching process to avoid duplication and accumulate all essential requirements.
| Author: | Sandra Zinsmaier, Hanno LangwegORCiDGND, Marcel WaldvogelORCiD |
|---|---|
| DOI: | https://doi.org/10.5220/0008960604730480 |
| ISBN: | 978-989-758-399-5 |
| Parent Title (English): | ICISSP 2020, Proceedings of the 6th International Conference on Information Systems Security and Privacy, February 25-27, 2020, Valletta, Malta |
| Publisher: | SciTePress |
| Document Type: | Conference Proceeding |
| Language: | English |
| Year of Publication: | 2020 |
| Release Date: | 2021/01/08 |
| Tag: | Common Criteria; GDPR; Privacy by Design; Requirements Engineering; Security by Design |
| Issue: | Vol. 1 |
| First Page: | 473 |
| Last Page: | 480 |
| Institutes: | Fakultät Informatik |
| Open Access?: | Nein |
| Licence (German): |  Creative Commons - CC BY-NC-ND - Namensnennung - Nicht kommerziell - Keine Bearbeitungen 4.0 International |
