Unlike typical functional requirements, security requirements can potentially be highly reusable, especially if specified as instances of reusable templates. In this column, I will discuss the concepts underlying security engineering including its quality subfactors. I will then address the issue of security requirements and how they differ from the architectural mechanisms that will fulfill them. Then, I will discuss the value of reusable parameterized templates for specifying security requirements and provide an example of such a template and its associated usage. Finally, I will outline an asset-based riskdriven analysis approach for determining the appropriate actual parameters to use when reusing such parameterized templates to specify security requirements.
Firesmith also provided reusable templates to specify security requirements REF .
Specifying reusable security requirements
Journal of Object Technology
Computer Science