Agile Security Requirements Engineering

Abstract

Agile processes have been deemed unsuitable for security sensitive software development as the rigors of assurance are seen to conflict with the lightweight and informal nature of agile processes. However, such apparently conflicting demands may be reconciled by introducing the new notion of abuser stories in the requirements domain. These extend the wellestablished concept of user stories to achieve security requirements traceability and thus open the door to excellent security assurance, precisely because of their informal and lightweight nature.