The research and application of security requirements analysis methodology of information systems

Generally, the security requirements analysis is a key process of security requirements engineering which includes the elicitation, analysis, verification and management of security requirements. Based on the existing security requirements analysis theories and approaches, this paper introduces two proposals to analysis the security requirements of information systems. The first proposal based on i* framework is mainly to model security requirements graphically with the help of si*-tool. The second proposal utilizes eight steps to obtain the final categorized and prioritized security requirements by using the techniques such as use/misuse case, attack tree, risk assessment and so on. To make it concrete, we use Disaster Recovery System to illustrate each proposal.