Defining a Software Engineering Process with Cost-effective Security Requirements Implementation

Today, security problems involving computers and software are frequent, widespread, and serious. The number and variety of attacks by persons and malicious software from outside organizations, particularly via the Internet, are increasing rapidly, and the amount and consequences of insider attacks remains serious. Security is not just a question of security functionality; the properties desired must be shown to hold wherever required throughout the secure system. Because security properties are systems properties, security is an omnipresent issue throughout the software lifecycle. This paper describes the existing software development lifecycle with the integration of security engineering process. After that, we will adopt the Information System Environment in the case of the University of Information Technology (UIT). Moreover, this paper describes an Information Security Software Engineering (ISSE) process for discovering and addressing users’ information protection needs based on the case study of UIT’s information System Environment. Finally, the proposed system performs the quantitative risk analysis on the study of UIT Information System Environment