Security Requirements Gathering Flashcards

What is a misuse case (abuse case) in security requirements gathering?

Answer: A scenario describing how an attacker could deliberately misuse the system's functionality

Misuse cases are the opposite of use cases. They model hostile actors and their goals, which helps identify security requirements that the system needs to counter them.

At which SDLC phase is it most cost-effective to define security requirements?

Answer: During requirements gathering at the start

Fixing security defects costs far more the later they are found. Defining security requirements at the start builds security in rather than adding it afterwards.

Which requirement is a well-formed, testable security requirement?

Answer: The system shall lock an account for 15 minutes after 5 consecutive failed login attempts

A good security requirement is specific, measurable and testable. Vague statements like 'should be secure' can't be verified.

Which OWASP resource is designed specifically as a source of verifiable application security requirements?

Answer: OWASP Application Security Verification Standard (ASVS)

ASVS provides tiered (L1–L3), testable security requirements that teams can adopt as their requirements baseline. ZAP and Dependency-Check are testing tools, and Juice Shop is a training app.

Which of these is a typical SOURCE of security requirements?

Answer: Regulatory and compliance mandates such as PCI DSS, HIPAA or GDPR

Security requirements come from regulations, industry standards, organizational policies, business risk and threat analysis. Compliance mandates are a primary driver.

In agile development, how are security requirements commonly captured?

Answer: As security user stories and acceptance criteria in the backlog

Agile teams write security user stories (for example, 'As a user, I want my session to expire after inactivity...') and add security acceptance criteria to the backlog, so security is planned and tested in every sprint.