Security Requirements Engineering
• SEI Report
Publisher
Software Engineering Institute
Topic or Tag
Abstract
When security requirements are considered at all during the system life cycle, they tend to be general lists of security features such as password protection, firewalls, virus detection tools, and the like. These are, in fact, not security requirements at all but rather implementation mechanisms that are intended to satisfy unstated requirements, such as authenticated access. As a result, security requirements that are specific to the system and that provide for protection of essential services and assets are often neglected. In addition, the attacker perspective is not considered, with the result that security requirements, when they exist, are likely to be incomplete. We believe that a systematic approach to security requirements engineering will help to avoid the problem of generic lists of features and to take into account the attacker perspective. Several approaches to security requirements engineering are described here and references are provided for additional material that can help you ensure that your products effectively meet security requirements.
Part of a Collection
Cybersecurity Engineering Research: Security Quality Requirements Engineering (SQUARE) Collection
Cite This SEI Report
Mead, N. (2010, July 14). Security Requirements Engineering. Retrieved September 18, 2026, from https://www.sei.cmu.edu/library/security-requirements-engineering/.
@techreport{mead_2010,
author={Mead, Nancy},
title={Security Requirements Engineering},
month={Jul},
year={2010},
institution={Software Engineering Institute, Carnegie Mellon University},
url={https://www.sei.cmu.edu/library/security-requirements-engineering/},
note={Accessed: 2026-Sep-18}
}
Mead, Nancy. "Security Requirements Engineering." Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, July 14, 2010. https://www.sei.cmu.edu/library/security-requirements-engineering/.
N. Mead, "Security Requirements Engineering," Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, 14-Jul-2010 [Online]. Available: https://www.sei.cmu.edu/library/security-requirements-engineering/. [Accessed: 18-Sep-2026].
Mead, Nancy. "Security Requirements Engineering." Software Engineering Institute, Carnegie Mellon University, Software Engineering Institute, 14 Jul. 2010. https://www.sei.cmu.edu/library/security-requirements-engineering/. Accessed 18 Sep. 2026.
Mead, Nancy. Security Requirements Engineering. Software Engineering Institute. 2010. https://www.sei.cmu.edu/library/security-requirements-engineering/