Defining your security requirements will help you out when performing various security related activities. When thinking of what can go wrong and trying to secure your system, having defined what is important to you just makes sense In addition, it helps prioritizing security-work, ex. patching vulnerabilities found in Snyk, prioritizing threats as part of Threat Modelling, or when doing Security Testing.
A security requirement is a statement of needed security functionality that ensures one of many different security properties of software is being satisfied. Security requirements are derived from industry standards, applicable laws, and a history of past vulnerabilities. Security requirements define new features or additions to existing features to solve a specific security problem or eliminate a potential vulnerability.
The first step would be to have a look at the business objectives and the functional requirements. From here you can derive security requirements by asking "what CAN'T go wrong" in order to meet these requirements.
A good place to define these requirements would be in the Requirements Document (having everything in one place and all that ), and gradually work towards having automated test-cases for them.
- Look at OWASP ASVS and find testable security requirements that applies to your application
- Have a look at our Guidelines
Define Security Requirements
What are some of the things I care about?
( * Take into account Confidentiality, integrity, availability.)
Define Compliance Requirements
Are there any special requirements that must be met (Compliance, and/or legal)?
- Business requirement documents
- Functional requirements documents
- Information security policies (ex. WR1211)
- Regulatory compliance documents (ex. SOX)
- Security standards & guidelines (ex. ASVS)
- Identity and access management requirements IT900 (Identity and Access Management)
- Description of the application functionality
- List of business objectives
- Definition of the application security and compliance requirements