## 6 Evaluation of Existing SRE Approaches
### Evaluation Iteration 1--Use Case Scenario 1
#### 6.1.1 Scenario Implementation Using Secure KAOS  
KAOS [17] (Knowledge Acquisition automated Specification or Keep All Objectives Satisfied), is a goal-oriented RE methodology developed as a joint collaboration of research work between the University of Oregon and the University of Louvain (Belgium) in 1990. The KAOS methodology mixes the top-down and bottom-up approaches. The goal modelling activity focuses on eliciting goals and refining them into sub-goals until they are atomic. Goal refinement is specified via AND/OR constructs. When a goal cannot be refined further, it is called as a requirement of the system-to-be and is assigned to an agent (to either environment or system agents) represented. When a requirement concerns an environment agent (e.g., human), it is called an expectation. Altogether, identifying and refining security goals and assigning them to agents are the core activities that are represented as goal and responsibility models. Authors of KAOS propose a formal specification language based on temporal logic. They also specify formal generic refinement patterns to validate goals refinements.  
Our experimentation was conducted using the free trial version of Objectiver [60] the official tool maintained by Respect-IT. Figure 6 depicts a sample of the goal model specified in our example scenario context. It required some effort to become acquainted with the tool and its terminology through the help of guidelines and cited references (refer to R\({}^{\text{M}}\)2.1.1 and R\({}^{\text{M}}\)2.1.3 criteria). In particular, the security experts expressed some concerns regarding the formal temporal logic language (R\({}^{\text{M}}\)2.1.1). They prefer the textual notation even it is more ambiguous.  
KAOS drives the RE analyst to define agents later in the RE process. As a consequence, it does not help in expressing the relation between the agents and their interaction dependencies which is important for the network design. For instance, while defining network agents (e.g., an access control system) in our scenario analysis, we encountered issues when we needed to add a new device in the network architecture. It was difficult to express the dependencies between network agents. In this regard, a conceptual diagram of the network would have been more concise and clearer. As a consequence, we had a difficulty in specifying network security requirements on network agents, particularly relative to security zoning (R\({}^{\text{M}}\)3.1). Furthermore, KAOS provides features to express abstractions and the notation provides a good support to achieve traceability by linking goals and sub-goals (R\({}^{\text{M}}\)4.1). However, it does not guide the security requirement engineers in asking the right questions at the right time to structure the security engineering process (R\({}^{\text{M}}\)3.2).  
Regarding integration of risk analysis concepts, the link between security requirements and risk information is explicitly expressed using the concepts of obstacles/anti-goals that are represented as relations such as obstruction/resolution. For example, in Figure 6, security goal \"PROTECTION NEED: monitoring data should be available when connected\" resolves anti-goal \"maintenance unavailable\". The resolution link is expressed using green arrowhead. These anti-goals can be further refined such as 'normal' goals resulting in the specification of attack trees. Obstacles/Anti-goals include two risk attributes likelihood and criticality (R\({}^{\text{M}}\)6.2) while security goals are attributed with ordinal priority scale (R\({}^{\text{M}}\)6.3). However, there is no explicit relationship defined between the priority of a security goal/requirement and the risk of an associated obstacle. In addition, it helps in observing the environmental constraints upon the goals through domain properties. (e.g., physical laws). For instance, the trust assumptions on agents are expressed using the domain properties (Cf. Figure 6).