Applying a security requirements engineering process

Abstract. Nowadays, security solutions are mainly focused on provid-ing security defences, instead of solving one of the main reasons for se-curity problems that refers to an appropriate Information Systems (IS) design. In fact, requirements engineering often neglects enough attention to security concerns. In this paper it will be presented a case study of our proposal, called SREP (Security Requirements Engineering Process), which is a standard-centred process and a reuse-based approach which deals with the security requirements at the earlier stages of software development in a systematic and intuitive way by providing a security resources repository and by integrating the Common Criteria into the software development lifecycle. In brief, a case study is shown in this pa-per demonstrating how the security requirements for a security critical IS can be obtained in a guided and systematic way by applying SREP.